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Preface 


Version 1.0 of this handbook was completed in 2004. Its purpose was to help forensic scientists 
prepare their laboratories for accreditation to ISO/IEC 17025:1999 General Requirements for the 
Competence of Testing and Calibration Laboratories. This seemed like a good idea because, in 
many ways, forensic sciences differ from more conventional branches of science, and some 
interpretation is often necessary when attempting to apply the requirements of a general standard 
like ISO/IEC 17025 to the specific analyses and examinations carried out in forensic labs. 

In May 2005, ISO published a revision of the standard, called ISO/IEC 17025:2005. Naturally, 
Introduction to Accreditation for Forensic Labs had to be revised as well. This is that revision. 

Upon close reading, it is clear that the changes in ISO/IEC 17025:2005 are not extensive, and 
most of Version 1.0 of this handbook is still valid. Nonetheless, there have been some changes. 
The main ones are listed here. 

1. The Introduction to ISO/IEC 17025:2005 has been revised, stating the relationship that 
exists with ISO 9001:2000. 

2. A new element, 4.10 Improvement, has been added, and new clauses or altered 
wording are found at 4.1.5(k), 4.1.6, 4.2.2(c), 4.2.3, 4.2.4, 4.2.7, 4.7.2, and 4.15.1. 

Mainly, these changes emphasize customer service, communication within the 
laboratory, and continuing improvement of the lab’s operation. 

3. The term “client” has been replaced by the word “customer”. 

4. The term “quality system” has been replaced by “management system”. 

5. Only minor changes, such as those found in 5.2.2 and 5.9.2, have been made in the 
Technical Requirements. 

Obviously, it will take some time and experience to determine specifically what a lab’s 
responses to these changes ought to be. In the following material, however, we offer you our 
best guesses as to the responses your lab might make. 
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Chapter 1. Introduction 

This handbook is directed at forensic laboratories, although the general requirements are 
common to all testing laboratories. It consists of some introductory material, followed by plain 
language descriptions and explanations of individual elements of ISO/IEC \1025 2005-General 
requirements for the competence of testing and calibration laboratories. These comments are 
keyed to the clause numbers of the ISO/IEC 17025:2005 standard so you will need your own 
copy to read along with this handbook. Following the “Notes and Commentary on ISO/IEC 
17025:2005” in Chapter 2, you will find a number of chapters which consist of somewhat longer 
discussions of certain topics that we thought might be useful to you. We will try to cover here 
all the things we found it useful to know, with the hope that they will be helpful to you. 

However, because we want to start at the beginning, that will mean that we will, from time to 
time, be discussing things that you already know. Please don’t be put off by that. Just skip the 
redundant material, and pick out what you feel you need. 

Our opinions and suggestions in the “we think.comments reflect each of our 
experiences in the context of the management and technical sides of the forensic laboratory, and 
from working in the application of the ISO/IEC 17025 standard. Your situation and the 
accrediting body with which you will work may require some slightly different interpretations in 
the application of the standard. 

In the chapters that follow, we intend to offer the basics to those folks who are beginning 
to prepare their laboratories for accreditation. It is written for the people who have just been 
picked to “lead the push to accreditation,” or to “champion quality in our lab,” or to “stand in as 
quality manager until HR decides whether we’ll hire somebody full time,” or whatever. We will 
assume that you are new to the quality assurance (QA) and accreditation business; and, as noted, 
we’ll start at the beginning. Part of the reason we chose this approach is that, in your new role, 
you are likely to have a serious selling job to do. Many of your forensic colleagues may not be 
very enthusiastic about accreditation, and some may be downright hostile. After all, they have 
been doing forensic examinations and successfully testifying in court for years, so what is the 
problem? It will fall to you, as the accreditation expert, to explain, to argue, and to persuade. 

We offer suggestions and discussion in the later chapters to provide you with some of the words, 
phrases, and arguments that have made sense in other forensic laboratories. Perhaps they’ll work 
in your laboratory as well. 

This introduction is also the proper place to warn you about the material that follows. 

One caveat is that this is not so much a book of instructions or prescriptions as it is a collection 
of opinions, suggestions and guidelines. You see, most of the requirements of ISO/IEC 
17025:2005 are simple enough, and mainly common sense. However, simple is not the same 
thing as easy; and, on many questions there is no single, right answer. The size of your lab, the 
scope of laboratory services, your police customers, and the resources available are all unique to 
your situation. How you address the elements of quality management, therefore, will be 
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determined by your specific situation. We hope to offer some ideas and opinions that will help 
you figure out what is best for your laboratory. 

We think this introduction is the best place, also, to consider some basic points. If you 
already know this material, feel free to ignore the next few pages and skip ahead to Chapter 2. 

1.1 What is Accreditation Anyway? 

Accreditation is defined as “formal recognition that a testing laboratory is competent to 
carry out specific tests or types of tests” (ISO Guide 2, replaced by ISO/IEC 17000 in the 2005 
revision). It involves a formal agreement between a recognized body that grants accreditation 
and the accredited laboratory that the following elements are in place to encourage reliable and 
accurate results: competent staff, proper facilities and equipment, appropriate procedures, and 
suitable quality control. The point is to increase the reliability of results and to assure customers 
(e.g. police investigators, courts, general public) that they are getting the quality of results that 
they expect. Although accreditation is not a complete guarantee of accuracy and reliability, the 
customer can have much greater confidence in results provided by an accredited laboratory. 
Accreditation has been around for years for many applications. Wherever it is found, it is about 
quality. 


In a little more detailed sense, accreditation is a process by which a laboratory is formally 
recognized, by an independent third party , to be scientifically and technically competent, 
according to some national or international standard , to do certain tests . This definition sounds 
as vague as it does because accreditation is applied in a wide variety of laboratories; it is not 
confined to forensic laboratories. Whatever the specific laboratory, however, the process is 
much the same. A laboratory decides it wants to be accredited, and it locates an appropriate 
accrediting body that is recognized and capable. Both agree on a set of performance criteria the 
laboratory will meet. For example, for general accreditation, the performance criterion might be 
ISO/IEC 17025:2005 alone. For a specialty area such as forensic science, the criteria might be 
ISO/IEC 17025:2005 plus an amplification document that is recognized by the forensic 
community as a specialty supplement. Once the laboratory has successfully achieved its initial 
accreditation, then the accrediting body ensures continued conformance with the accreditation 
criteria in a variety of ways. The laboratory may be required to submit annual surveillance 
questionnaires, for example. The accrediting body will certainly conduct on-site audits (also 
called inspections or reassessments) at specified intervals (e.g. 2 years). 

All of this is fascinating, but specifically, how does it apply to you? Let’s pick out the 
key points (underlined above) and explore them in a little more detail. 
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Process of improvement 


First, accreditation is best seen as a process . That is, it’s a course of action for quality 
improvement that continues indefinitely. Accreditation is not like a final exam in calculus, for 
example, an exam where one can cram furiously, pass it, and promptly forget the material. 

One guiding principle in ISO/IEC 17025:2005 is that the laboratory must strive for, and 
be able to demonstrate, continuous improvement in its management system. This requirement 
was present in ISO/IEC 17025:1999 but it has been emphasized in the 2005 revision. Once 
initial accreditation has been achieved, the next audit will be looking at how your laboratory has 
been handling such things as correcting mistakes (nonconformances and corrective actions), 
monitoring your management system (internal audits and managerial reviews), making 
improvements (preventive actions), cultivating the relationship with customers, as well as 
following your laboratory’s own policies and procedures. To emphasize, accreditation is 
concerned with the way a laboratory does business and conducts its technical operations. 

Independent third party 

Second, consider the phrase independent third party . If you want to know whether a 
particular business is trustworthy, you would likely have more confidence in the advice of a 
professional colleague than in the opinion of a company salesman. This is a question of bias. 
Besides, laboratories are about technical and scientific procedures. There is usually more 
confidence if that portion of the work is judged by technically qualified peers, who are not 
directly associated with the laboratory. Independent, third-party scrutiny is very convincing. 

A recognized standard 

The third point concerns the national or international standard that your lab’s 
performance has to meet. There are examples of professional organizations-medical, chemical 
and forensic-which saw a need for peer recognition for analytical or testing laboratories. Some 
programs have been established. Although there was some participation from international 
laboratories, for the most part these have been looked at as national programs serving a particular 
profession. 

In about the 1980s, however, there was considerable interest in promoting standards of 
quality in all types of laboratories that would be recognized internationally. As we discuss later, 
it was about this time that the International Organization for Standardization (ISO) first set out 
guidelines for the assessment of laboratories. As you have seen in the ISO/IEC 17025:2005 
standard, the requirements for a laboratory management system include both managerial and 
technical elements that apply to all types, specialities, and sizes of testing laboratories. This 
means that individual requirements in ISO/IEC 17025:2005 have to be interpreted for individual 
subject areas or disciplines. The interpretation process may lead to documents that amplify the 
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requirements of ISO/IEC 17025:2005, addressing much more specifically the details of the 
specialty area. Whatever the case, the core document is ISO/IEC 17025:2005. It is an 
international standard, created by technical committees of an international organization (ISO). 
Because of that, it carries a great deal of credibility. 

Scope of testing 

Fourth, how about the phrase to do certain tests ? Your laboratory decides which tests or 
examinations you are going to offer to customers. That’s part of “saying what you do.” The list 
of tests you offer will ultimately form the core of your lab’s Scope of Accreditation. However, 
while the accrediting body will not dictate what tests you offer, it does impose some limits of its 
own. For example, the accrediting organization will only accredit objective tests, and it will not 
accredit a laboratory for a test that the lab has never done. So, to begin with, you determine 
which tests you want to offer customers, and you determine how those tests or examinations are 
to be done. We’ll see later what your lab is required to do about validating and documenting the 
methods it uses. For the moment, however, the guiding principles are quite simple: best 
laboratory practice, best professional practice, and demonstrable scientific competence will 
determine how a given test is carried out. The accrediting body will simply be making sure that 
your laboratory follows those principles as part of “doing what you say,” ensuring what you do is 
in compliance with the standard. 

So, what sorts of laboratory activities are covered by the requirements of ISO/IEC 
17025:2005? After you have read through the standard a few times, we think you’ll agree that it 
requires pretty much what any of us would expect of any competent laboratory, encompassing 
both management and technical elements. The laboratory must have a management system that 
is appropriate to the type of tests being done, and the detail s of that system must be documented. 
Generally, the standard does not prescribe specific quality control measures but does expect that 
appropriate measures are being followed. Again, you decide exactly what is to be done in your 
laboratory on the basis of best scientific practice and your capabilities and resources. Note that 
for some specialty areas, such as forensic science, supplemental guidelines may require 
implementation of particular processes. An example is the inclusion of elements from accepted 
practices (e g. FBI Quality Assurance Standards in DNA Testing Laboratories 1998.). Details of 
your system-who does what, when it is done, how it is done-will be written (documented) for all 
managerial, administrative, and technical processes. In fact, there is a rule of thumb among some 
of the people who do audits: “if it ain’t documented, it didn’t happen.” You have to be prepared 
for this. If your laboratory does not now have administrative procedures and analytical methods 
written out, and those documents signed and controlled, you have a lot of preparation to do. 

More about that later. 
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Applying for accreditation 

Once you have the full commitment of your senior management and you have your 
management system implemented and successfully operating for a period of time, such as a 
completed cycle of proficiency tests or one round of internal audits and management reviews, 
you may apply for accreditation. Select the accrediting body that best meets your requirements 
for a general laboratory accreditation, or for an accreditation specific to forensic labs. In either 
case, all elements of ISO/IEC 17025:2005 apply. When your application is accepted, the 
accrediting body will need to visit your lab. An agreement will be made between you and the 
accreditation body as to the conditions of the visit. This includes timing, members of the 
accreditation team, estimated costs, and the general plan as to how the audit will be conducted. 
The audit team must understand and follow your security controls. 

The accreditation team will audit your operation with two main questions in mind: to 
what extent does this laboratory actually do what it says it does, and can it demonstrate through 
documentation, records, and quality assurance practices that it is technically competent to do it? 
The assessment deals only with those tests you have listed in your application for accreditation. 
It cannot touch upon any tests you do not claim to do, although for some accrediting bodies in 
the forensic field, you must list all the forensic tests/examinations that are offered by your 
laboratory. 

After your laboratory has been accredited, you are required to provide assurance to the 
accrediting organization that your management system is operating properly. The accrediting 
body will require evidence of continuing compliance by receiving annual updates and also by 
conducting a full reassessment of your laboratory at some defined frequency. 

And that’s it: using ISO/IEC 17025:2005 as your guide “Say what you do, do what you 
say, demonstrate your scientific competence, and document the essentials.” 

1.2 ISO and the Standards 

The International Organization for Standardization, commonly known as ISO, is a 
federation of national standardization bodies from over 110 countries around the world. ISO is 
based in Switzerland. Its mission is essentially to promote the development of standardization 
and related activities to facilitate the international exchange of goods and services. Part of ISO 
activities includes organizing international committees and writing standards on multiple topics. 
To support the many technical committees and sub-committees (about 1,000), some thirty 
thousand scientists and engineers are involved from around the world. To date, approximately 
10,000 international standards on various subjects have been published. These international 
standards cover a vast range of topics such as how steel should be graded, how the strength of 
textiles should be determined, how seat belts should be made, how fasteners should be designed, 
and so on. Most serve to facilitate standardization in manufacturing and international trade. 
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Although laboratory testing is recognized as an important activity, it represents a relatively small 
part of the ISO operation. 

Probably the best known international quality management standard is ISO 9001, which 
is widely used throughout the world for companies and agencies that provide manufactured 
goods, or supply services. It is a standard that is strongly based in quality management and 
relationships with customers. Registration to ISO 9001 tells customers that the company (or 
laboratory) has a management system that has been audited by an accredited registrar, and the 
company’s procedures meet the requirements of this international standard. As we stated before, 
this part of the quality business is summed up in the catchy slogan: “Say what you do, and do 
what you say.” There is nothing to prevent a laboratory from becoming registered to ISO 9001, 
and several have taken this step. 

There is a significant difference, however, between registration and technical 
accreditation. In the former process, a third party auditor reviews the quality documents 
(company procedures) to ensure they are in compliance with ISO 9001 and checks that these 
procedures are being followed. By contrast, in technical accreditation, a team of scientific 
experts assesses, not only the company procedures as noted for ISO 9001, but also the technical 
and scientific competence of the laboratory to do what it claims to do. Such an assessment 
includes such things as the qualifications of personnel, the scientific validity of test and 
calibration procedures, and the use of proficiency testing. Of course, the assessment will also 
confirm that the laboratory is following its own stated procedures, which must meet the 
requirements of the ISO/IEC 17025:2005 standard. Accreditation for testing laboratories is 
provided by only a few official ISO accrediting bodies. 

In the early eighties, an ISO committee, in cooperation with the International 
Electrotechnical Commission (IEC), published ISO/IEC Guide 25 - General Requirements for 
the Competence of Calibration and Testing Laboratories, which encompassed applications for 
both testing and calibration laboratories. A later development, combining the management 
elements of a quality system included in ISO 9000 (1994) and the technical elements of Guide 
25, resulted in a much superior standard for laboratories. This standard, named ISO/IEC 
17025:1999 was published in 1999. It provided the means for laboratories at the national and 
international levels to recognize one another’s test results. ISO/IEC 17025:1999 has been 
adopted verbatim by national accrediting bodies in over 35 countries. Then in early 2005, ISO 
published a revised version of this standard, entitled ISO/IEC 17025:2005. Officially, 
laboratories have been given two years from the date of publication to comply with the new 
version, although we urge you to check the specific date with your accrediting body. 

The International Laboratory Accreditation Cooperation, or ILAC as it is known, is an 
organization with representation from international committees that seeks to identify technical 
conditions that enable the many ISO-adherent nations and organizations to have further 
confidence in each other’s accreditation programs. This is done through ILAC Guidelines, 
which are suggested amplifications of ISO/IEC 17025 that promote a minimum technical 
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performance or condition, related to specific topics. Some examples of ILAC publications are: 
Policy on Traceability of Measurement Results (ILAC - P10: 2002); Introducing the Concept of 
Uncertainty of Measurement in Testing with Application of the Standard ISO/IEC 17025 (ILAC 
G17: 2002); Guidelines for Forensic Science Laboratories (ILAC Guide 19:2002). 

Another organization that provides similar assistance in promoting excellence and 
uniformity in the accreditation to the ISO standards is the Asia Pacific Laboratory Accreditation 
Cooperation (APLAC). 

The influence of these organizations is shown in the program specialty supplements, such 
as those for forensic laboratories. 

Accrediting bodies 

In Australia, Canada, United Kingdom, New Zealand, and many other countries, the 
accreditation programs are supported in part by national governments. In the United States, 
accrediting bodies (ABs) come under the authorization of the National Cooperation for 
Laboratory Accreditation (NACLA), which uses a formal process to recognize ABs that 
pass a thorough evaluation. As of January 1, 2005, there are six ABs recognized by NACLA. 
The current list is available at www.nacla.net . Those ABs which the NACLA Acceptance Panel 
finds to be competent are invited to become signatories of the NACLA Mutual Recognition 
Arrangement (MRA). Under the MRA, each AB is required to treat the accreditations, test 
reports and certificates of the other signatories as technically equivalent. 

There are two organizations in the USA offering accreditation services for forensic 
science testing. They are the American Society of Crime Laboratory Directors / Laboratory 
Accreditation Board (ASCLD/LAB) and Forensic Quality Services - International (FQS-I). The 
ASCLD/LAB (www.ascld-lab.org ) offers two programs, a Legacy program, which is not based 
on ISO/IEC 17025, and the ASCLD/LAB - International program, which is based on ISO/IEC 
17025. FQS-I (www.forquality.org ) gained NACLA recognition in September 2004, and is a 
signatory to the NACLA MRA. 

In Canada, accreditation for forensic laboratories is offered by the Standards Council of 
Canada (www.scc.ca). 

All these organizational details notwithstanding, there are two points we want to 
emphasize. First, ISO/IEC 17025:2005 was written by scientific experts from several countries. 
This may be something your colleagues should know, as they will want to be reassured that the 
requirements of the standard represent the thinking of qualified scientists, and not the whim of 
some bureaucrat who knows nothing of science or of managing a laboratory. 

The second point is the implicit assumption behind the requirements of ISO/IEC 
17025:2005 and ISO as an organization. That assumption is that there are two major goals: 
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quality and standardization. In the context of lab operations, we can probably take quality to 
mean “reliability of results” (we will discuss this in more detail later). Also, perhaps we could 
agree that standardization means “we all do our work to the same specifications.” Now, it’s 
pretty clear that quality and standardization are related concepts, but they are not exactly the 
same thing. It is easy to imagine a scenario in which a number of labs all follow a certain 
analytical method to the letter, but the method itself is flawed, so that it generates unreliable 
results. In this, we see a high degree of standardization but poor quality. Conversely, we could 
imagine several labs generating very reliable results for a certain analyte using quite different 
methods of analysis. The standardization is not great, perhaps, but the results are of good 
quality. Why does this matter? 

We think there is no doubt that ISO/IEC 17025:2005 demands a high degree of scientific 
and technical competence of all laboratories, including forensic labs. So, the requirement for 
quality, for reliable lab results, is there. It is also our belief that standardization is, all by itself, a 
useful and positive force in forensic sciences. If we all do our work to the same specifications, 
we are able to compare results with one another, from lab to lab, from country to country, and 
this is an essential first step to making our work in forensic science more reliable. 

1.3 Why Should Our Lab Bother to Become Accredited? 

This is one of the first questions any lab should answer. Certainly anybody involved with 
QA and accreditation would be wise to give the question some thought because many of your 
colleagues will be asking you. Accreditation will mean extra work for them and they’ll want to 
know why they should bother with it. Your boss might want to know, too. 

In some places, the law requires that forensic laboratories be accredited. If that’s your 
situation, the question is answered for you. But, what if there’s no legal requirement? Why 
would your lab voluntarily take on the task of becoming accredited? Some of the benefits that 
are generally cited are: increased confidence of personnel in their work, improved control of 
operations, increased credibility with customers, and savings of time and money. The savings 
may not be obvious at first, but a close look at administrative and technical procedures in terms 
of quality usually yields increased efficiencies and effectiveness. The customers (police and 
justice officials) see an improved management system in the lab; have a better liaison with, and 
understanding of, the laboratory; and have increased confidence in the laboratory’s services. 

Your lab may well find that better purchasing practices can save money, and fewer calls to 
testify in court can mean more time in the lab for casework. Your laboratory will have its own 
unique reasons, and we leave it to you to figure out exactly what they are. From previous 
discussions, however, we can offer you some other observations. 

Accreditation can be a real source of pride for the people in your laboratory, and that can 
lead to improved morale. To successfully meet the requirements of a demanding standard like 
ISO/IEC 17025:2005 is a definite accomplishment. To have the same accreditation status as 
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your peers (national and international) is also an important factor. Perhaps that’s a reason that 
could interest your lab’s management. There may be other reasons, too. 

For example, the climate in which forensic laboratories operate has changed over the past 
ten or twenty years. These days, the courts and the public are generally much less likely to put 
their complete trust in a single authority, and that includes forensic experts. Accreditation by a 
credible third party may offer some assurance. And when you think about it, there aren’t many 
alternatives. 

Compare the benefits of accreditation with other ways of demonstrating to your 
customers how good you are. You and your colleagues could tell them what great work you do. 
This is probably a good idea, but your views would no doubt be seen as biased. You could invite 
your customers into your lab to see for themselves what tests you do and how well you do them, 
but is this really meaningful? Not to be pompous, but your customers are not likely able to 
really judge your scientific/technical caliber, and their visit to your lab may not be much more 
than a “gee-whiz” exhibition for tourists. Finally, your customers could hire forensic scientists 
from some other organization to visit your lab and critically evaluate the quality of your work. 
Their review might be skewed, however, by the varied philosophies of the team members. They 
may not be judging you uniformly with the standard of quality that would match that of the 
internationally accepted standard ISO/IEC 17025:2005. Doesn’t accreditation sound preferable? 

1.4 Some Questions, Pitfalls and Warnings about Lab Accreditation 

Quality is no accident. Your organization has to plan for it, work at its implementation, 
be prepared to maintain it, and constantly strive for improvement. It is important to remember 
that accreditation is (usually) a voluntary process. There are questions, however, that can be 
raised about accreditation; perhaps your colleagues will raise some. Let’s look at a few 
important ones. 

There is no doubt that accreditation costs time and money. Preparation will take a lot of 
your scientists’ time, and the accreditation body itself charges a fee. It is legitimate to ask if this 
is proper use of your lab’s resources. If your lab pursues the accreditation process 
conscientiously, you can predict more reliable test results and a higher degree of confidence 
among your customers that they are getting what they expect. Be warned, however, if the 
accreditation process is not conscientiously pursued, and you plan to prepare for the on-site visit 
over a few months simply to get it over with, and then go back to life as usual, it will not work. 
The accreditation process and conscientious assessors will not allow you to fake it, and your time 
and money would be wasted. 

Another question that can legitimately be raised goes something like this: isn’t 
accreditation just a lot of change for the sake of change, massing up piles of paper that ought to 
have been left as trees? We think there are two or three ways to answer this. To begin with, 
accreditation doesn’t necessarily demand any change in your lab’s practice. If your lab is 
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already running in a way that meets the standard, nothing has to change. And, as noted earlier, 
that standard arises from the notion of best professional practice, with some common sense 
thrown in. We urge you, then, to ask yourself the obvious question: if your lab is doing 
something now in a way that isn 7 up to the standard, that isn 7 best lab practice, why are you 
doing it that way? In such a situation, accreditation to ISO/IEC 17025:2005 will require change, 
that’s certain, but it can hardly be called “change just for the sake of change.” Finally, 
accreditation can require a substantial collection of paper, although totally electronic systems are 
used and are quite acceptable. Documentation is a crucial part of the process, however. 
Depending on the procedure acceptable to the accrediting body, the accreditation team may use 
hard copy or electronic copy for reviewing your documentation prior to, and during, the 
accreditation visit. Once on site, the audit team will be talking with staff and looking for signed 
statements that a particular procedure was done, or that a particular check was carried out, as 
required. So, some documentation is unavoidable. 

There may be concern that accreditation is an unwarranted intrusion into the professional 
conduct of the individual specialist. After all, scientists often have their own ways of doing 
things-forensic scientists perhaps more than others-and they may resent somebody looking over 
their shoulder, second-guessing them. The fact is, as just noted, as long as what they are doing is 
best professional practice, there will be no problem. However, any looking-over-the-shoulder 
can easily be felt as a personal threat. Scientists are likely to resist any process that makes them 
feel they have to defend their actions as a matter of personal survival. It seems to us that 
accreditation offers the chance to minimize this sense of personal threat. Your lab will design 
and put into operation a system of analysis and examination, a system that meets high standards. 
In doing so, there is frequently a change of focus, away from the individual and onto the system. 
When that happens, it is much easier for you and your scientist colleagues to see that there may 
be a weakness in the system , and set about fixing it, than it is for a scientist to admit that he or 
she personally blundered or made a bad judgement. 

In addition, any looking-over-the-shoulder that is done in accreditation is done by people 
who know the science. So, the audit process amounts to a form of peer review, and that is quite 
consistent with best professional and scientific practice. 

We have one more warning to offer you, and this may be the most important one of all. 
Here it is: if you do not have the complete support of your senior management, don’t even begin 
the process of accreditation. Find yourself another project because this one is likely to crash and 
burn. We believe (and the authors of books on quality that we have read support this) that you 
must have full, visible commitment from your top management. We think there are two major 
reasons why this is so crucial. 

First, as noted earlier, preparation for, and maintenance of, accreditation costs time and 
money-quite a lot of each. If your management is not committed from the beginning, there is a 
good chance that QA will lose its resources when some more interesting or urgent project comes 
along. Your senior management needs to know right at the beginning that the commitment of 
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time and money to QA will continue every year for as long as they choose to be an accredited 
laboratory. 

Second, your colleagues will be watching closely what The Boss does. If he or she 
obviously has a fire in the belly for quality in your laboratory, then you as Quality Manager will 
have a much easier time selling QA to your colleagues. However, if The Boss is indifferent, 
your colleagues will be, too. And you will not be successful convincing them of the value of 
accreditation. 

We do not intend this to be pessimistic, just realistic. Your senior management deserves 
as clear a picture as you can provide of what resources will be needed to achieve, and then 
maintain, accreditation status. For example, it sounds reasonable to suggest that the preparation 
phase, in which your lab is getting ready for its first assessment, will need more resources than 
will the maintenance phase, after accreditation has been granted. In our experience, this is the 
way things ordinarily happen. We want to stress, however, that there is a cost of maintenance 
for a management system and it would be a serious mistake for you to let your senior 
management believe otherwise. Incidentally, ISO/IEC 17025:2005 requires statements from 
senior management of their commitment of support to the management system. 

What is the bottom line? The best we can offer you here is an estimate, but that is 
probably all you need. As a rough rule of thumb, your lab can expect to spend 10 - 15% of the 
budget on QA, particularly in the preparation stage, when salary costs are likely greatest. Once 
your management system is implemented and you have successfully achieved accreditation, 
these costs usually drop somewhat. As mentioned before, there can even be some small gains 
through new efficiencies such as better purchasing practices, fewer repeated analyses, fewer 
errors, and less time in court. Depending on the size and complexity of your laboratory, the 
position of quality manager can be full time, or a part time activity of a forensic scientist doing 
other duties. In larger sections of the laboratory, quality assurance duties are often a part of the 
duties of a scientific specialist or technician. All these positions, whether full time or part time, 
do cost money, as does some of the extra time needed in record keeping, calibration, proficiency 
testing, and other QA activities. Finally, your accreditation organization will charge fees and 
your laboratory pays the expenses of the assessment teams that come into your laboratory. 
Totalled up? About 10-15% of your lab’s budget. 
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Chapter 2. Notes and Commentary on ISO/IEC 17025:2005 

There are three things we should clarify right off. 

First, as you read the elements of the standard ISO/IEC 17025:2005, you may recall the 
standard was written with a double-barreled purpose. It was written to guide labs toward 
competence in terms of more accurate and reliable work, certainly. It was also written to 
enhance the acceptance of laboratory results among nations. So standardization is an important 
theme running through the document as well. 

Second, ISO/IEC 17025:2005 was written for laboratories of all sizes and sorts. We are 
convinced that the authors had in mind primarily quantitative physical and chemical 
measurements when they composed the elements of this standard. As a result, you will see 
important concepts like traceability, validation of methods, and uncertainty of measurement 
treated at length in the standard, and properly so. In a number of ways, however, forensic 
laboratories are not typical laboratories. The testing done in a forensic laboratory is mainly 
qualitative: chemical identification, comparisons of known and questioned items, and so on. 
Qualitative tests do not fit very well into some of the concepts laid out in the elements of the 
standard. As a result, sometimes it may not be entirely clear what ISO/IEC 17025:2005 requires 
of a forensic laboratory. This is not an insurmountable problem; it simply requires interpretation. 
Whatever you do, however, please do not dismiss an element as “not applicable” simply because 
it is not immediately obvious how your lab might comply. Your lab will be audited to every 
element in the standard. This means that some serious thought will be required from time to 
time. 


Finally, as a specific manifestation of the second point, ISO/IEC 17025:2005 speaks of 
both “testing labs” and “calibration labs.” A calibration lab is an establishment that, for a fee, 
takes in other labs’ instruments and calibrates them for use. This probably does not describe 
your operation. Your lab is a “testing lab.” As part of your testing activities, however, you may 
do in-house calibrations of some of your own instruments. We raise this because there is the 
possibility of confusion in your interpretation of the standard. Most of the requirements of 
ISO/IEC 17025:2005 apply to both types of lab. In a few places, the requirements apply to 
testing labs only, or to calibration labs only. You have to read carefully to know whether certain 
phrases in the text apply to your lab or not. 

This handbook is intended to be read in parallel with ISO/IEC 17025:2005, so you will 
definitely need a copy of the standard. Details of the text of ISO/IEC 17025:2005 are not cited 
here. Be aware, however, that all of these clauses must be covered off, either in your Quality 
Manual or in supporting documents. 
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Many international accreditation bodies recognize forensic science laboratories as a 
program specialty area, and support amplification of the ISO/IEC 17025:2005 standard to meet 
forensic applications. We will include some amplification elements in the comments that follow. 
We’ll set these elements apart, in italics, so that it’s as clear as possible which comments apply to 
ISO/IEC 17025:2005 and which apply to an amplification document. In part, these 
amplifications reflect clauses from the guide of the International Laboratory Accreditation 
Cooperation (ILAC) Forensic Working Group, and from the ASCLD/LAB International 
document. Supplemental Requirements for the Accreditation of Forensic Science Testing and 
Calibration Laboratories. You are advised to become familiar with the particular forensic 
amplification document used by your accrediting body. 

To make the reading as easy as possible, the following material uses the numbering, and 
some of the headings, of ISO/IEC 17025:2005. 


4 Management requirements 

4.1 Organization 

4.1.1 Legal responsibility... 

You need documentation on file showing that your lab is an identifiable legal entity. 
If your lab has a charter, or a statement of policy of your parent organization, or 
articles of incorporation, use that documentation. If there is a statute that brings your 
lab into existence, that’s what you want. 

4.1.2 Meeting requirements of ISO/IEC 17025:2005 and the customer... 

A statement in your Quality Manual to the effect that your lab addresses both the 
requirements of the standard and your customers’ needs will probably do the trick. 
(See the section on the Quality Manual later.) 

4.1.3 Permanent, temporary and mobile lab facilities... 

Think carefully through all the tests and examinations you do. If any part of your 
casework is done at a location other than your lab building, you’ll have to account 
specifically for all those activities as well. For example, if you have a satellite lab for 
breath test equipment, your management system has to encompass it. If some of your 
examiners work at a home office, you need to show that they are subject to 
supervision, security, and so on there, just as they are in your lab building. 
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4.1.4 


Conflict of interest... 


Your lab’s organizational chart can be the basis of your response to this item. You 
should pay particular attention to the relationships it shows. For example, if your 
forensic laboratory is part of a larger police organization or government department, 
make sure you can demonstrate a professional independence from other parts of the 
organization. A policy statement in the QM that your laboratory results are free of 
bias and outside influence can be used. This can be supported by reference to a 
conflict of interest document your staff members are required to sign. 

4.1.5(a) Individuals who affect the quality of the laboratory test result... 

We suggest you think about this element in terms of the “individual-with-authority.” 
Basically, you want to identify, either by position or by title, the individual who has 
the authority and the money to identify problems and fix them. Suppose, for 
example, one of your chemistry technologists identifies a problem with the mass 
spectrometer, a problem that might mean erroneous test results have been reported. 
Who is the person in the laboratory with the power to stop all further analyses on that 
mass spectrometer? Who can sign the purchase order to get a repair person on site? 
Who has the authority to recall the lab reports from the past two weeks if the results 
are in question? Who has the authority to start the analyses again once the mass spec 
is repaired? You get the idea. And this clause now includes the first specific mention 
of “improvement” in the revised standard. We’ll hear more about it later. 

4.1.5(b) Freedom from internal and external pressures... 

This is usually thought of as a conflict of interest clause that can be covered offby a 
policy statement in the Quality Manual. As noted above, make sure that each of your 
lab’s employees has signed and dated a conflict of interest agreement. Give them a 
copy and you file the original. 

Read this item again, carefully. You will want to give some thought to what might be 
included in “internal...pressures and influences.” What pressures might exist inside 
your lab that could affect the quality of your work? You might consider backlogs of 
casework or special requests from over-zealous investigators or counsels. You may 
have to resolve this, especially if your laboratory exists within a larger organization. 

4.1.5(c) Customer confidentiality... 

Work on the assumption that every piece of information your lab gets from a 
customer is absolutely confidential. Then design policy and procedures to ensure that 
the information is held secure. Part of your response to this element could be a non- 
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disclosure agreement signed by each of your lab’s employees, possibly at the same 
time they signed the conflict of interest agreement noted above. Then think through 
the details of how and where your lab handles customer information. You might 
review the security measures in your building, or in individual sections. You may 
want to consider who ought to have access to what information, and put restrictions 
on that, if necessary. 

4.1.5(d) More on conflict of interest... 

Mostly, this will have been covered off in your policies under 4.1.5(b). 

4.1.5(e) Lab’s organizational relationships... 

The organizational chart(s) should show the position of your laboratory within the 
larger organization and the reporting relationship between management, QA staff, 
and technical operations. For example, if you have individuals who split their time 
between technical operations and QA activities, you can bet that, when the caseload 
gets heavy, there will be a strong urge to take time away from the QA function and 
put it on casework. That could be risky, so be sure to cover it off. 

4.1.5(f) Authority of scientific personnel... 

This clause focuses more closely on the scientists and technologists whose work 
touches the examination of exhibits and the reporting of the results. Think of one of 
your lab’s reports and ask yourself whose work affects the accuracy of the 
information in that report. Describe the activities and the roles of staff who handle 
case work. It will certainly include the analyst who operated the gas chromatograph 
and the instrument technologist who maintained it. It would also extend to the person 
who typed the report and the one who checked the result. Just make sure you have 
described clearly the responsibility and authority of each of those people. 

4.1.5(g) Qualification of supervisors... 

This clause draws attention to the need for supervisors to be technically qualified for 
the tests/examinations that they oversee, and to give supervision time that is suitable 
for the number of staff The wording here does not insist that the supervisor be a full- 
fledged expert in a specific specialty, but he or she does have to know enough about 
the field to be able to tell whether results make sense or not. For example, a veteran 
forensic trace chemist, who has had recent training in drugs, should know enough 
about the techniques of drug identification to be able to supervise the drug section. It 
may be more difficult, however, to argue that the same forensic chemist would be a 
suitable supervisor for a firearms section. 
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Amplification: Supervisor qualifications are specifically definedfor DNA testing 
labs. 

The issue of proper supervision may raise another aspect to this clause you should 
think about. What is your lab’s policy about examiners working alone? This is 
especially an issue if you have people working off-site (at a home office, for example, 
as mentioned in the above clause on lab location). The clause does not insist that 
every examiner have a supervisor looking over his or her shoulder every minute of 
every working day. If, however, your lab’s arrangements allow an examiner to work 
at home alone for three days every week, for example, think seriously about exactly 
how that person is being supervised. 

4.1.5(h) Technical management... 

This is not complicated, but we believe it’s useful, once again, to think in terms of an 
individual who is your technical manager rather than some foggy concept of technical 
management just arising spontaneously from a group. We believe some scientific 
training is called for; your lab needs to decide precisely what training is needed. In 
some situations, “technical management” is an activity shared among several 
individuals. This is acceptable as long as it is explained in the Quality Manual. 

4.1.5(i) Quality manager... 

Your lab does not have to have a full-time person with the title of “quality manager.” 
It must, however, have an identified person assigned responsibility for QA. The staff 
member who acts as the QA manager can also operate in another capacity, such as a 
bench scientist reporting to the section manager. For the purposes of quality 
assurance, however, he or she must report directly to the laboratory director. Ensure 
the organization chart shows this direct reporting relationship. 

4.1.5(j) Replacements for key personnel... 

The phrase “key managerial personnel” includes the lab’s director, the technical 
manager, the managers of individual sections, the quality manager, possibly a few 
others. You might make a table showing the names or positions of those who act in 
place of another. Make sure your policy around this question shows how you handle 
coverage for both expected absences, such as vacations, and unexpected absences, 
such as those due to illness. 
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4.1.5(k) 


Personnel involvement... 


This clause is new in the 2005 revision. We suggest that, whatever the specific 
means chosen by management to convince staff members of the “relevance and 
importance of their activities”, make sure the message gets to all staff members, and 
consider making this process a regular activity (e.g. weekly or monthly). And, since 
objectives of the management system are specifically mentioned, you should 
probably make sure they are clearly linked to this process. Also, when you are 
working on this requirement, it might be useful to check 4.1.6 and 4.2.4 below. 

4.1.6 Communication... 

This is another new clause, and we suggest that you pay close attention to the words 
used. For example, it is clear that “top management” has to get this communication 
process established, at least, even if it is later delegated to someone else. We also 
urge you think seriously about a few of the details, e.g. does this imply regular 
communication? Frequent communication? Should it be confined only to good news 
about the system’s effectiveness? Or should it also include observations where the 
system is not as effective as it should be? 

And to repeat, as you work on this clause, you might want to consider 4.2.4 below. 

4.2 Management system 

4.2.1 Lab’s management system... 

This element covers a lot of territory on creating, implementing, and maintaining the 
management system. Notice the focus. The goal is to “assure the quality of the test 
results”- in other words, to assure their accuracy. Then the clause goes on to say, 
essentially, that every single thing you do in your lab that can affect the quality of the 
test results has to be covered off in your management system. Note carefully the 
wording of the last sentence in this clause. What measures will you take to 
“communicate” the management system documentation to “appropriate personnel”. 
How will you demonstrate that they have understood it? What does “available to” 
mean? Here are some thoughts. 

Your documentation can be either electronic or hard copy. If your lab says that 
Manual X is on your local network, make sure that everybody who needs to use 
Manual X can actually find it on their computer. If, on the other hand. Manual X is a 
big, black binder in your lab, you would be well advised to have it on a shelf close to 
the work site, or at least in your library or your coffee room. This touches upon 
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availability: if you keep Manual X in a book case behind the lab director’s desk, it’s a 
lot more difficult to argue that it is “available.” 

The requirement that you demonstrate that the documentation is “understood” by the 
folks in your lab may be quite a stretch. Use of a circulation sheet to show that staff 
members have at least had the document in their hands is one approach to show its 
distribution. Holding short briefing sessions with all staff (with records of 
attendance) on the management system is a more responsible approach. Many quality 
managers follow this up with a brief quiz to demonstrate employees’ understanding. 

4.2.2 Quality Manual... 

The five elements required in the quality policy statement are covered in Chapter 5, 
The Quality Manual. This particular clause also refers to the higher-level statements 
in the manual, such as the objectives and the statement of purpose, which must be 
shown to have the support of the laboratory director (i.e. a signed policy statement). 
These statements can be brief. They are typically not more than a sentence or two. 

4.2.3 Management’s commitment... 

This is another new clause, emphasizing the required involvement of top management 
in the system and its continuing improvement. Our best guess is that evidence of the 
required “commitment” would begin with a clear statement, possibly in the Quality 
Manual. That may be all you need, but we believe that the requirement for 
“continually improving” implies that top management’s commitment ought be on¬ 
going. Think about the evidence you might produce to support that. 

4.2.4 More on communication... 

This clause is new and involves top management. It appears to link with 4.1 5(k) and 
4.1.6, and you might find it useful to think of three clauses together. 

4.2.5 Other documents such as procedures, SOPs, instructions... 

This refers to much more detailed documentation, including standard operating 
procedures (SOPs), instructions or methods for performing examinations, directions 
for running certain instruments, and so on. These documents have to be referenced 
from the Quality Manual, but we suggest you be careful about how the reference is 
actually made. Try to make the references in such a way that, when you revise a SOP 
for example (and you certainly will), you do not also have to revise the Quality 
Manual. A flow chart showing all your lab’s quality documentation (i.e. policy, 
procedures, work instructions, records), and its organization, is useful here. 
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4.2.6 More on technical management and quality manager... 

This has already been covered off, but this element is a reminder that the technical 
manager and quality manager positions have to be described in the Quality Manual. 

4.2.7 Keeping things together... 

This clause is new and again it involves top management in any changes occurring in 
the management system of the lab. It is not clear what all might be embraced by this 
requirement but we suggest that, at least, any changes to the management system 
ought to be reviewed by the Quality Manager (for example) to determine whether the 
proposed change has any implications for the accreditation status of the laboratory. 
Any potential consequences are passed up the chain of responsibility. Beyond that, 
however, the word “integrity” could potentially extend further. 

4.3 Document control 

4.3.1 General requirement to control all lab documents... 

This element is, in our opinion, one of the giant-killers. It will cause you more grief, 
eat up more of your time, and annoy more of your scientific colleagues than any other 
element in the standard. The design and implementation of an effective document 
control system can be quite challenging, and it requires constant vigilance to keep it 
up. This is an area where external auditors often find nonconformances in the 
management system. 

We discuss document control in more detail in Chapter 6. For now, we suggest you 
study this section side-by-side with 5.4.7 and 4.13, and think it through. The basic 
idea is that every piece of paper, every computer file, every form, every document, 
that is part of your lab’s operation should fit clearly in the management system that 
you have defined. This includes any current “external” procedures, such as federal/ 
provincial/ state regulations that apply to your forensic work. The flip side of 
document control is that there should be no orphans, no bootleg documents, no 
unofficial items, no stray bits and pieces in use. The following elements spell out in 
more detail what’s needed. 
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4.3.2 


Document approval and issue... 


4.3.2.1 Master list of documents... 

Make a table listing all of your lab’s quality documents. This is the master list. 
Decide who authorizes each document for use. Describe your procedures for 
ensuring that only the current version of each document is used, and describe how 
your colleagues will know that the document they use is, in fact, the current one. 

4.3.2.2 Procedures for document control... 

There is nothing very complicated here. Take positive steps to make sure documents 
are readily available wherever they’re needed. As noted earlier, this is an easy one to 
miss if your lab chooses to make a particular document available only in electronic 
format. To see the document, people obviously need access to a terminal, and they 
need to know which directory to find the document in. Naturally, if common sense 
demands that you place a paper copy at a certain bench in your lab, do that. 

Specify what your lab means by “periodically reviewed,” and be prepared to defend 
your choice. Keep a record of these reviews. 

How, exactly, are you going to remove all obsolete documents from use? At a 
minimum, you have to circulate a memo or an email advising your colleagues to 
destroy the obsolete document. For hard copies, you can require the return of 
obsolete documents so you can personally see to their removal. You may want to 
consider search-and-destroy missions from time to time. Don’t overlook this point, 
however. As always, keep records of these responses and activities. 

There are several ways to mark obsolete documents. A big stamp, OBSOLETE - 
FOR ARCHIVE USE ONLY, in red ink would likely be suitable. A filing system 
that keeps a copy of obsolete documents physically separate from current documents 
is pretty well essential. 

4.3.2.3 Information on controlled documents... 

This element is very useful: it lays out the basic information you need to have on 
every document in order to demonstrate it is under control. Let’s look at a couple of 
points. 

First, it does not matter what the identifier is. It can be a name or a number, or some 
combination, but it must be unique. Second, we strongly suggest you simply adopt at 
the outset the convention of numbering pages X-of-Y (i .e. page # of total pages) on 
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all documents. There are other ways to comply with this point, as suggested in this 
element; but, in our experience, these alternatives are rarely worth the trouble. 

4.3.3 Document changes... 

4.3.3.1 Revising documents... 

The point here is that you don’t want to have an authorized document changed by just 
anybody, whenever he or she feels like it. The person who gave original 
authorization is, pretty much by definition, the person who should authorize changes 
to it. The element allows delegation of this task to an informed person. 

4.3.3.2 Identifying the revised material... 

New or altered text has to be identified to users, either on the documents themselves 
or in a record of revision describing the change made. Some electronic systems log 
all changes in detail. That’s fine. It’s certainly possible to show deletions and 
additions to hard copy, using redline and strikeout features, although it can result in a 
very cluttered document that may be confusing to read. Use your judgement on this 
point. 

4.3.3.3 Amendment by hand... 

Unless you have a truly compelling reason to do otherwise, we suggest you ban 
altogether the “amendment of documents by hand” (i.e. handwritten notes). If you do 
allow temporary amendments by hand, carefully follow the guidelines in the standard. 

4.3.3.4 Control in computerized systems... 

Commercial document-control software packages are available with the supplier’s 
instructions. However, if your lab uses a hybrid system (some digital documents and 
some hard copy), be aware that all the above requirements about authorization, 
revision, and so on, apply to both parts of your system. 

4.4 Requests, tenders and contracts 

4.4.1 The review has to include... 

This element can be a bit confusing for public sector forensic laboratories. The 
language of the standard speaks in terms of a “contract” existing between the 
laboratory and its customers. Of course, the “contract” for forensic laboratories is the 
understanding between the police departments and your lab to have certain 
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examinations performed. This understanding may not be a written document at all. 
Remember, however, that ISO/IEC 17025:2005 encompasses all sorts of labs, and 
sometimes the fit with a forensic lab operation may be less than perfect. The standard 
states that such a contract must exist and that your lab must have a policy to review it. 
Your lab needs a procedure governing how you decide whether you have the 
resources and expertise to address the customer’s request. Your procedure should 
indicate how targets for turnaround time on results are negotiated with the customer. 
All of these factors may be covered in a “Statement of Services” type of agreement 
developed by your laboratory in consultation with its police customers. 

Any suggestion that the customer (investigator) will select or determine the method of 
testing is - in our opinion - not an acceptable option in a forensic laboratory. The 
reasoning is simple: scientific personnel in the laboratory are the only people qualified 
to decide what methods of analysis are suitable. In other types of testing laboratories, 
it may be quite appropriate for the customer to specify the analytical method to be 
used, but not in forensic work. It is essential that your customers accept your 
leadership in this regard. 

4.4.2 Keep records... 

In spite of all the words in this element, you are essentially being told to keep records 
of the results of your customer contract reviews. 

4.4.3 A point on subcontracting... 

Subcontracting has a section all its own (4.5 below). This item simply emphasizes 
that if your lab subcontracts analyses to another organization, your lab is responsible 
for following ISO/IEC 17025:2005 protocols in that relationship, too. 

4.4.4 Communication with your customer... 

This may be another small snag for a forensic laboratory, but don’t ignore it. You 
must have policy as to when and how to inform investigators if you are not going to 
be able to meet your service agreement or contract with them. If agreed-upon 
turnaround times cannot be met, or if the intended examination turns out to be 
impossible or impractical, you must contact the investigator and re-establish the 
understanding. 
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4.4.5 Amending a contract... 

This element is quite clear. If the contract has to be amended, for whatever reason, 
make sure the amendment is reviewed, just as the original contract was. Ensure that 
everyone who needs to know of the amendment is notified. 

4.5 Subcontracting of tests and calibrations 

4.5.1, 4.5.2, 4.5.3, 4.5.4 The main points of subcontracting... 

It is quite acceptable for your laboratory to subcontract certain analyses, which are 
defined within your Scope of Accreditation, to another organization for unforeseen 
reasons, such as excessive backlogs or a need for outside expertise. That other 
organization may be independent of your lab, or it may be another part of your 
organization. The bottom line is this: if you use a subcontractor, you must have full 
confidence in their service. You can demonstrate this by using a laboratory that is 
accredited under ISO/IEC 17025:2005 for the specific test or examination. A copy of 
their certificate on your file of all subcontractors would do the trick. If the 
subcontractor is not accredited to ISO/IEC 17025:2005, your lab must establish 
confidence by regularly auditing the subcontractor to the appropriate elements of 
ISO/IEC 17025:2005, relative to the subcontracted tests/examinations. The record of 
such audits on your file satisfies this requirement. 

Consider the status of your subcontractors carefully. It may be that your 
subcontractor is accredited to some other standard, and it may be that the 
subcontractor’s accreditation is equivalent to ISO/IEC 17025:2005 accreditation, but 
don’t count on it. If you don’t have documented evidence of your subcontractor’s 
accreditation to “this International Standard,” make arrangements soon to go in and 
audit them. (Chapter 11 will provide some help with this.) Such an audit, by the 
way, has to apply only to the specific tests you are subcontracting out. The rest of 
your subcontractor’s operation is outside your responsibility. (However, if you saw 
that the operation on your specific tests was neat, orderly, and conforming; but the 
rest of the subcontractor’s operation looked like it had been bombed, wouldn’t this 
raise questions in your mind 9 ) 

4.6 Purchasing services and supplies 

4.6.1 Purchasing supplies and services... 

There’s nothing really mysterious here, except that your lab may not have these 
procedures written out as clearly as they should be. To begin with, we suggest that 
you not waste a lot of time in endless debate over whether a certain supply or service 
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truly “affects the quality of tests” or not. Just assume that they all do, and get on with 
it. 

A second point is that you may not be able to account for the history of some supplies 
as completely as you should. One usage of the term “traceability” has it that you 
should be able to trace any reagent or instrument clearly back to the time you 
acquired it (see Traceability, Chapter 9). This requirement suggests that the ordering 
and receipt of each bottle of reagent, for example, should be recorded in an orders 
file, or something like that. The bottle of reagent should be marked with the date of 
receipt and the initial of whoever received it. Finally, it would be wise to include an 
expiration date right on the label. 

4.6.2 Verifying that supplies are suitable... 

This element is straightforward enough: it merely says that your lab has to ensure that 
reagents, and so on, are suitable for the purpose for which you intend to use them. 
There are a couple of points that need to be emphasized. First, you must set the 
criteria by which these supplies are judged. Second, these criteria must be specified 
in your test methods. Finally, you have to show that the supplies are suitable before 
you use them on genuine case samples. To pick an example, suppose one of the 
procedures for drug screening in your Toxicology section uses n-chlorobutane as an 
extraction solvent. Your lab’s criterion for suitability of that solvent might state the 
maximum acceptable signal detectable by gas chromatography after a certain volume 
of the solvent is evaporated to dryness, reconstituted, and injected. The criterion 
would be written in the method for that drug screen. You would have shown that 
each new batch of n-chorobutane has met this criterion before you used the new 
solvent in casework. In addition, you would have a record (in the form of a gas 
chromatogram, perhaps) of that acceptance. 

4.6.3 Review of purchase orders... 

To further ensure that the purchasing process is a controlled procedure, define who 
approves and signs purchase orders before they are sent out. Note that this approval 
includes a technical evaluation of the services and supplies being ordered, not just a 
financial approval. 

4.6.4 Approval of suppliers... 

If you don’t already have a list of suitable suppliers for at least the critical 
consumables, make one. Then think about how your lab evaluates those suppliers. If 
the supplier is ISO 9001 certified, ask for a copy of their certificate, as that is a good 
indication of a reliable company. 
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In many situations, as with proprietary kits and reagents, there is only one supplier, 
who is not ISO certified. In others, you may have done evaluations, however 
informally, based upon the supplier’s delivery record, their product quality, or their 
follow-up service. Document such evaluations to demonstrate you have given 
thought to the quality of your suppliers. 

4.7 Service to the customer... 

4.7.1 Cooperating with your customers... 

This is another item that may not at first appear to be a very good fit for a forensic 
laboratory. It is somewhat redundant on the matter of keeping customers informed. 
Your policies and procedures should include the provision that the customer has the 
opportunity to observe your operations. Obviously this has to be done at your 
convenience, ensuring all confidentiality and security issues are met. This also 
relates to the occasional requests by courts to have defense counsel examine evidence 
in your laboratory. Define your procedure for these events. 

The revised version of the standard has introduced a change here. The 1999 version 
used a Note to encourage labs to get feedback from their customers. Because it was in 
a Note, however, this point carried only the weight of a suggestion. The Note was 
deleted in the 2005 version and its content was placed in a new clause, described 
below. 

4.7.2 Customer feedback... 

This new requirement says that your lab must seek customer feedback. It is no longer 
a suggestion. So, make sure you have some formal, documented procedure for getting 
that feedback. You should think of this as an active process, initiated by your 
laboratory, not a passive thing, like sitting back waiting for customers to phone (see 
4.8 Complaints, below). A written or electronic survey of customer satisfaction, 
conducted at regular intervals, is one way to measure your performance. Keep 
records of the feedback you receive, both good and bad, as well as of your responses 
to that feedback. Receipt of good news and service appreciation should also be 
logged. Both parts are important and must be used a part of your improvement 
process. This is specified as part of management review (4.15). 
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4.8 


Complaints 


If your lab doesn’t already have one, create a complaints file. Please note that the 
standard requires your lab to keep a record of ALL complaints. You will also need a 
written procedure for handling the complaints, which identifies the individual(s) 
responsible for investigating the complaints, correcting any problems, and contacting 
the customer. All that information forms part of the record. 

4.9 Control of nonconforming testing and/or calibration work 

4.9.1 When test results are wrong... 

Let’s be clear: “nonconforming work” can mean a test result or a lab report that is (or 
may be) inaccurate. But we suggest you interpret the term more broadly, perhaps 
using the definition of nonconformity from ISO 9001, which is: “non-fulfillment of a 
requirement”. The key idea here is that something has gone wrong - possibly serious, 
possibly not so serious - and this element requires your lab to have a comprehensive 
written procedure that you follow whenever something does go wrong. That 
procedure will, once again, identify the individual(s) with authority. Who has the 
authority to stop testing, to recall reports already issued, to order that necessary 
changes to lab procedure be implemented, and to order that testing resume once the 
problem has been fixed? 

The 2005 revision of the standard provides clarification of a point that, in the 1999 
version, created some confusion. Let’s digress for a moment to consider this point. 

In ISO/IEC 17025:1999, 4.9.1(c), the lab was required to take corrective actions 
immediately whenever nonconformity was detected. The use of those two words - 
corrective actions - naturally led the reader’s attention to 4.10 Corrective Action, 
immediately following. That was not the intent. Rather, 4.9.1(c) of the 1999 version 
was intended to mean simply “fix the problem”, and only to invoke the more 
complicated and formal Corrective Action procedure (4.10) if it was necessary to do 
so. The laboratory would know when that was necessary because in the required 
evaluation of the significance of a nonconformity (ISO/IEC 17025:1999, 4.9.1(b)), 
they would check for the necessary conditions given in 4.9.2. That clause said that 
Corrective Action (4.10) was required if (a) the nonconformity was likely to recur or 
(b) there was doubt about the lab following their own policies and procedures. 

The 2005 revision of ISO 17025 clarifies that situation by stating at 4.9.1(c) that 
“correction is taken immediately”. This rather unusual terminology is further clarified 
by reference to ISO 9001 definitions. That document says that “ correction ” is “action 
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to eliminate a detected nonconformity” whereas “ corrective action ” is “action to 
eliminate the cause of a detected nonconformity...” It emphasizes that “...there is a 
distinction between correction and corrective action.” 

This distinction is important because, as just noted, some problems in a laboratory are 
serious but many are not, and the laboratory could scarcely afford to respond to them 
all by invoking the Corrective Action procedure. It would be wasteful and 
inappropriate to do that. So, when you are writing your procedure(s) for dealing with 
Nonconforming Work, you will need to give some thought to how you classify 
nonconformities, how you decide between a nonconformity that has simply to be 
fixed, and one that requires Corrective Action, as described in 4.11. To illustrate what 
we mean here, consider as an example, the analysis of blood alcohol. 

If the result for the control material fell outside acceptable limits one day, that would 
be a nonconformity, in the broad sense described above. Your procedure would 
require that the reason for the out-of-control value would be tracked down and fixed, 
the analyses would be repeated, and a record would be kept. This is what the control 
material is for, and we would conclude that the system is working fine. This is a 
nonconformity but it is not “something-gone-wrong”. 

If, however, a scientist observes one day that the absolute ethanol reference material 
has not been properly stored and, as result, there is some doubt about the accuracy of 
blood alcohol values the lab has been reporting, this would be a nonconformity, too, 
but it is obviously much more serious. The same nonconformity procedure just used 
would apply here as well. During the evaluation of the significance of the 
nonconforming work (4.9.1(b)), you would recognize the potential seriousness of this 
problem, and your procedure would guide you to the conditions of 4.9.2, and possibly 
to the formal Corrective Action described in 4.11. 

Experience during investigation of these problems suggests that it is wise to look first 
at the lab’s analytical system. It is a matter of asking what is wrong with the system 
that such a problem happened, and then asking how should the system be changed to 
fix that problem. This will usually identify the problem and solve it. However, there 
are times when the system is not at fault, times that the problem is substandard 
performance by one or more of the lab’s employees. Make sure your policy and 
procedure account for that possibility as well. 

4.9.2 Going on to 4.11, if necessary... 

To reiterate what we described above, this clause tells you that there are two 
situations in which your remedial action procedure has to lead to a Corrective Action. 
First, you proceed to 4.11 promptly if it appears that the nonconformance could recur. 
Second, if your initial investigation of the nonconforming work shows that your lab is 
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not following its own policies and procedures, that triggers the Corrective Action 
procedure of 4.11, as well. 

4.10 Improvement 

This is a new element in the 2005 revision. Note that improvement has been inserted 
in several earlier clauses; this one expands the notion somewhat. The standard 
appears to consider continuous improvement the key to an effective management 
system, and it lists seven tools for improving management effectiveness. These are: 
quality policy and objectives, audits, corrective and preventive actions, management 
reviews, and analysis of data. Your lab must be able to demonstrate that there are 
procedures in place to facilitate continuous improvement through the use of these 
tools. 

When you are working this out, we suggest that you consider a couple of basic 
questions. This may be a tough requirement for a forensic lab to meet because there 
may be the belief that lab results are already sufficiently accurate, understandable and 
timely to meet the needs of investigators and courts, and what’s the point of getting 
faster and more accurate if customers don’t need it? Perhaps you need to find out if 
your clients really are completely satisfied with your service. Perhaps you need to 
widen your enquiry to include factors that do not impinge directly on the test report, 
such as administrative or financial matters, as possible areas for improvement. 
Whatever you decide, if you are going to be able to demonstrate continuing 
improvement, don’t you need some way (or ways) of measuring effectiveness? What 
will those ways be? How are you going to collect the necessary data? Who will do it? 
Only your lab can decide. 

4.11 Corrective action 

4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5 Procedure for identifying root cause... 

Please recall what we wrote in 4.9 above before proceeding - go back and reread it, if 
necessary. OK? Then let’s carry on. 

The items in this element provide specific guidance on the procedures you have to put 
in place to deal with problems in operational and technical matters. It may be 
somewhat surprising to see the degree of formality that is expected from your lab in 
this area. Distinguish between the corrections you made in 4.9.1(c), and the formal 
Corrective Actions procedure being described here. The Corrective Actions 
procedure is designed to identify the root cause of the problem. As part of the 
Corrective Actions procedure, be sure the records show that it has been completed, 
signed off, monitored and, if necessary, audited. 
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It must be emphasized that the Corrective Action procedure you write is part of 
“saying what you doNaturally, it will also be expected that you “do what you say.” 
If past practice in your lab was that, whenever something went wrong, you kept your 
head down and your mouth shut until the crisis blew over, your lab has a lot of work 
to do. 

4.12 Preventive action 

4.12.1, 4.12.2 Procedure for anticipating problems before they occur... 

Initially this can be a difficult concept to interpret. First, its location in the standard, 
right after “Corrective Action,” implies that the two items go together, perhaps even 
leading logically from one to the other. Not necessarily true. Read 4.12, Note 1 
carefully. An ISO-based management system is always striving for improvement. 
Procedures in which your lab has identified and fixed nonconformities have been 
described in 4.9. These are followed, if necessary, by the implementation of 
Corrective Action described in 4.11. These clauses deal with what you do to handle 
problems that have already occurred. By contrast, 4.12 deals with what the 
laboratory does to make improvements and prevent nonconformances from happening 
in the first place. This clause is, therefore, tied more closely to 4.10 than it is to 4.9 
and 4.11. An example of a preventive action might be the monitoring of turnaround 
times for your reports. If you see turnaround times (TAT) beginning to increase, your 
management might choose to take preventive action. That is, a nonconformity of 
exceeding the TAT target has not yet occurred, but some action is taken to make sure 
one doesn’t occur. 

Sometimes it is useful simply to think of things your lab has already done to improve 
some part of its operation. Often, those improvements can be interpreted as ways of 
preventing nonconformances. They would likely “count” as Preventive Actions if 
they were documented properly. 

Preventive Actions might also arise from monitoring critical points and performance 
measurements of your total operations. Occasional staff meetings to scout out 
potential problems or make improvements, involving all levels of administrative and 
technical activities, are often useful for identifying Preventive Actions as well. 
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4.13 


Control of records 


4.13.1 General 

4.13.1.1, 4.13.1.2, 4.13.1.3, 4.13.1.4 Requirements for keeping records... 

As a forensic scientist you will already appreciate the need for keeping records of the 
examinations conducted for presentation in court. Aligned with the Control of 
Documents (4.3), the control of records is a major part of your management system. 
The standard specifies that you have procedures describing how your lab identifies, 
collects, indexes, accesses, files, stores, maintains and disposes of records. Make sure 
that you have covered each one of these activities. 

4.13.2 Technical records 

4.13.2.1, 4.13.2.2, 4.12.3.3 Requirements for keeping case files... 

The term “technical records,” commonly known as the case file, refers to the notes, 
readings, instrument printouts, chain of custody record, uncertainty estimates (if 
appropriate), and interpretation of results that the lab gathers in a given case. 

Similarly, the term “quality records” includes a range of specific records relevant to 
the test or examination such as those for equipment maintenance, temperature 
monitoring, verification of balances, calibration of mass spectrometers, analysis of 
control materials, and so on. Some of this information has to be included in, or at 
least referenced from, the technical record in order to make it complete. The technical 
file must be complete in the sense that it has to record accurately everything that was 
done on the case-who did it, when it was done, what the results were, how they were 
interpreted, and what conclusions were drawn. 

Unless the retention and disposal of your records are already covered in policy of your 
parent organization, or in defined legal requirements, your lab will have to decide how 
long to keep such quality records. However, since you have to be able to link a given 
case file to the related quality control activities going on at the time the case was 
analyzed, you have to retain both records for the same time period. 

Although the standard speaks of the file containing enough information to permit 
repeating the analysis, it does not specifically mention the slightly different slant that 
may be more pertinent to forensic labs. That is, the technical file should contain all 
the information necessary to permit an independent, competent forensic scientist to 
assess completely the original work, and thus to be in a position to come to the same 
conclusion as the original examiner did. By the nature of forensic samples, an 
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accurate repeat test may not be possible, so it is essential that a complete record is 
made, should a second review be required later. 

Clause 4.13.2.3 defines the manner in which a mistake on a record is corrected. There 
is no room for correction fluid, erasers, or sticky notes. 

Amplification: Case records include such things as relevant telephone conversations, 
continuity forms, and evidence packaging and seals. Observations and test results are 
preserved, where possible, so they can be interpreted by another person. Checking by 
a second person of significant observations or of calculations that are not part of a 
validated electronic process should occur and be recorded. Pages of records are 
uniquely identified, traceable to the analyst/examiner, and numbered with the total 
number ofpages. If a result or observation is discarded, state the reason. Where 
multiple case data are on the same printout, the cases must be uniquely identifiable. 
Any handwritten notes must be in ink. Record the date(s) of the examination, and 
initial any additions to the test/examination record. 

4.14 Internal audits 

4.14.1, 4.14.2, 4.14.3, 4.14.4 Requirements for auditing your own lab... 

Your lab must audit itself to verify that its management system (both 
management/admini strati on and technical areas) is functioning properly, and is in 
compliance with its own procedures and with ISO/IEC 17025:2005. There is no 
option on this. You must plan internal audits, create a schedule, and organize how it 
will be done. You may choose to do an audit of all elements, or an audit of different 
sections/units throughout the year, or different elements of the management system at 
different times. That is up to you. You have to decide who will participate in the 
audit, recognizing they have to be trained, qualified, and preferably not directly 
connected to the work area being audited. In short, you have to be satisfied that your 
auditors are capable of providing you with an objective and competent result. 

A complete internal audit must be conducted once a year as a matter of routine, and 
more often if necessary. Why would more often be necessary? Here are a couple of 
reasons. Perhaps you have had a wheel come off in one of your analyses, for 
example, and you want to document that everything has been properly fixed. So, re¬ 
audit just that bit of the operation. Maybe a new process has been implemented and 
your management wants to check to make sure it’s working as well as expected. A 
quick audit of that process might be in order. The results of the internal audit will 
likely identify actions that have to be taken to fix things. If the audit uncovers a 
serious problem, you may have to consult with your customers, invoke your 
Corrective Actions procedure, and so on. 
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In the preparation for your initial accreditation assessment from your accreditation 
body, you will find that internal audits are a very powerful tool for identifying things 
that still have to be done. That process might be called a “gap audit”. The audits are 
also an effective way of helping your colleagues come to grips with the details of the 
standard because you will enlist them to work with you on audit teams. There is no 
better way to understand ISO/IEC 17025:2005 than to figure out how it applies in a 
colleague’s section. The process encourages the culture change that is necessary in 
some labs as they become accustomed to the idea of somebody “looking over their 
shoulder.” 

Chapter 11 provides suggestions about performing internal audits. 

4.15 Management reviews 

4.15.1., 4.15.2. Requirements for review by your lab’s management... 

Here’s another activity that the accrediting body will expect to be done annually by 
top management. The management review demonstrates that senior management is 
committed to, and involved in, the operation of the laboratory and its management 
system. The requirement for improvement, noted in several earlier elements, is 
present again in this one. The list of points that the review has to take account of 
includes “recommendations for improvement”, an item not present in the 1999 
version of the standard. In a sense, this clause can be the Quality Manager’s friend in 
those situations in which senior management is a little aloof, or where compliance of 
some staff is lacking. The standard forces at least some tangible degree of 
management contact and, with the emphasis on improvement in the 2005 version, the 
involvement of top management is expected to increase. 

The content of the managerial review is clearly described. Our only comment here is 
to urge you to help your senior management run these reviews formally. That means 
a formal written review, a meeting of management (perhaps using the bullets of 4.15.1 
as an agenda), written minutes of the meeting with a list of action items, and a formal 
acknowledgment by the Laboratory Director. 
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5 Technical requirements 

5.1 General 

5.1.1, 5.1.2 Explanatory material... 

This is mostly preamble that lists some of the factors affecting “correctness and 
reliability.” It does provide you with notice, however, that uncertainty of 
measurement is going to be an important factor in the elements to follow. This is dealt 
with in more detail in Chapter 10. The question of how uncertainty is to be handled in 
forensic science has not been completely settled yet, but it is being discussed by a 
number of authoritative organizations, such as International Laboratory Accreditation 
Cooperation (ILAC). You will want to stay abreast of these discussions. 

5.2 Personnel 

5.2.1 Qualifications... 

Education, training, experience, and demonstrated ability of individuals are the main 
factors by which the laboratory determines the competence of its staff. It must all be 
documented. An individual’s training record will contain copies of diplomas and 
degrees, as well as records of any other professional development courses 
(internal/external training) that he or she has taken. If there were any tests of 
competence during this training such as written exams, mock trials, or practical tests at 
the bench, record them and their results. When the training is completed, there ought 
to be a formal statement (such as a memo, signed by the appropriate person) 
authorizing the trainee to take on specific casework. As mentioned in the Notes, there 
may be additional considerations for staff who are required to be certified, and/or who 
provide opinions and interpretations of test results. 

Amplification: Staff must have proper knowledge, skills and abilities, and have a 
proper curriculum vita on file. Procedures for retraining and maintenance of skills, 
andfor court training, should be in place. Competency tests are often required prior 
to conducting testing/examination on casework. Specific requirements for the 
qualifications of technical personnel are commonly cited in many forensic specialty 
areas, which are unique to forensic accrediting bodies. Provision for sources of 
relevant forensic information for each discipline is required. 
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5.2.2 Identifying training needs... 

The goals for training and professional development must be set by laboratory 
management. These goals lead to procedures for identifying training needs. While 
you’re writing the policy and procedure, be sure that training needs are identified 
through a formal plan, as opposed to some unwritten custom. This does not have to 
be elaborate, but your lab is supposed to be taking training seriously. An additional 
statement in the 2005 revision of the standard requires the lab to evaluate the 
effectiveness of training actions taken. We suggest that you give this new 
requirement some thought because it may not be as simple as it appears. That is, it is 
common practice in many organizations to make training of various sorts available 
and then simply to assume that the training actually accomplished what was intended. 
We doubt that such an assumption would meet this requirement. 

5.2.3 Competence of all employees... 

This element emphasizes that your lab is responsible for the competence and 
supervision of every examiner or analyst (including persons under contract as well as 
support staff) who does case work for you. 

5.2.4 Job descriptions... 

Don’t worry too much about the specific job positions listed in this element. For 
some reason, the standard is listing a minimum here. The simplest thing is to have a 
current job description for everybody in your lab, no matter what his or her duties. 

It’s probably good organizational practice, in any case. You can assume that 
“current” means not more than a year old; and, even if a job description does not 
have to be revised in any given year, you should assume that it still has to be 
reviewed, updated, and signed off. 

5.2.5 Authorization of personnel to perform specific tasks... 

This adds some further detail to the requirements in 5.2.1. The emphasis is clear: the 
standard expects management of your lab to know what everybody in the 
establishment is doing and to have authorized those activities in writing. 
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5.3 


Accommodation and environmental conditions 


5.3.1 Lab surroundings... 

The requirements of this element are clear enough, but it is worth your while to walk 
this one through in detail. We suggest that you categorize all the tests and 
examinations you do in your lab as to their operating and environmental 
requirements. (This is also suggested in Chapter 4; so, if you do it now, you’ll be a 
step ahead). Go through the list, item by item, asking yourself, or your colleagues, 
whether there are environmental conditions that have to be controlled in order for this 
test to be done properly. What about temperature? Humidity? Vibration? Noise? 
Dust? Power supply? High purity water? Those conditions in the laboratory that are 
important to achieving accurate and reliable results should be outlined (or referenced) 
in the management system manual. Then see the next element. 

5.3.2 Monitoring environmental conditions... 

If you have identified environmental conditions in 5.3.1, now you have to monitor 
those conditions and, of course, log the results. For example, if you have decided 
that the temperature of a room or freezer is a factor, it’s simple enough to set a 
thermometer, read it at defined intervals, and record the result. It’s even simpler to 
use a device that records temperature continuously. 

On the other hand, if you have an area that has to be “clean,” such as a room in which 
an examiner searches for gunshot residue, or one in which fibres searches are 
conducted, it may be a bit more challenging to decide what the monitoring procedure 
should be. Take the time now with your colleagues to work it out. 

5.3.3 Cross-contamination... 

We expect your lab is already attending to this, simply because cross-contamination 
is a risk well known to forensic scientists. Nevertheless, during your work-up on this 
element, look for all the areas in which you search for trace evidence of any kind, or 
in which you analyze for trace quantities of anything. Write your policy and 
procedures, and make sure they include monitoring practices. Examples of such 
precautions can be to keep DNA samples (pre- and post-amplification) separated, 
solid drug standards away from the drug extraction area, and solvents out of the arson 
lab. 

Amplification: Separation of areas of high-level and low-level work, and controlled 
access to work areas, are required. 
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5.3.4 Control of access to the lab... 

Security measures will certainly be in place at any forensic laboratory. This is, 
however, a good time for you to determine exactly what is needed and to document 
the appropriate procedures. 

You will decide who is to have access to what areas within your lab. Check your 
records for distribution of keys/cards to make sure you know they are adequate and 
consistent with your new security policy. Be sure this policy covers such things as 
visitors, police investigators, trades people, and after-hours security. How about 
emergency calls to fix a plumbing leak on the weekend? Do the workers sign in? 

Do they receive a card? Are they always accompanied by a lab employee? Take a 
fresh look at these practices. 

Amplification: Requirements are outlinedfor visitor restrictions, internal/external 
and after-hours security features, and accountability of keys and magnetic door 
cards. There is an emphasis on evidence storage areas. 

5.3.5 Housekeeping... 

Document the procedures to maintain and clean the laboratory. Describe the 
cleaning frequency and controls, especially if cleaning is contracted to persons 
outside the direct control of the laboratory. If certain areas are to be cleaned only by 
lab staff, specify that here. Although safety requirements are not specifically 
mentioned in ISO/IEC 17025:2005, accreditation bodies will often cover this in their 
amplification documents. Also, this is the area of ISO/IEC 17025:2005 in which 
matters of health and safety can best be described. 

5.4 Test (and calibration) methods and method validation 

5.4.1 Methods and instructions... 

Because the standard is dealing with labs of all types, including both testing and 
calibration labs, the language gets a little fuzzy. The term “appropriate method” 
means one that would be judged suitable by the scientific community or by qualified 
scientific peers. For example, a single spot test would not be considered an 
appropriate method for the chemical identification of heroin for forensic purposes. 

The thrust of this element is that your lab has to have written instructions (methods, 
SOPs) for all the analyses and examinations you do, and for all the instruments you 
use. They must be written in enough detail to satisfy your own forensic criteria and 
those of a peer scientist who may be technically assessing your method for 
accreditation. 
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Decide who authorizes the SOPs and put this in your document control procedure. 
The phrase “readily available” appears again in this element, and it means the SOP 
ought to be at the bench, or beside the instrument, at which the instructions will be 
carried out. This may be a matter of contention among your colleagues because 
experienced examiners will often operate from memory. However, operating from 
memory is the best way to ensure that a given procedure is not done the same way 
by everybody. The expectation in a management system is that procedures will be 
done as specified, every time, no matter who does them. 

The Note regarding published standard methods of analysis refers to those published 
by established sources such as ASTM or AO AC. Probably few of the methods used 
in your lab are of this type. Any laboratory citing the use of a standard method must 
not make any deviation from that method, and generally has only to demonstrate its 
successful operation. It is not necessary to conduct a full validation procedure. 

5.4.2 Selection of methods... 

This element is fairly clear: use the method that meets the forensic needs of your 
customer. The use of standard methods is discussed, but as mentioned, they may 
not be applicable to most forensic samples. Appropriate methods taken from 
professionally accepted publications are more commonly used. They must have 
first been validated in your laboratory. It is also quite acceptable to use methods 
that you have developed in-house, providing they have been thoroughly validated. 

It may not be enough to simply claim that you have used a method for twenty years 
and it must, therefore, be valid. Method validation is a big topic. (See Chapter 7 for 
discussion.) 

Amplification: Tests must be fully validated and documented before use, 
particularly new methods. There are guidelines for infrequently used 
tests/examinations. There are requirements for the quality of standard materials 
and reagents, including quality controls, labeling and record keeping. 

5.4.3 Laboratory-developed methods... 

Write a policy for your lab describing how new methods are to be validated, who is 
to do it, and who finally approves the method for use. 
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5.4.4 


Non-standard methods... 


The wording of this element is a little confusing. The essence of it is to make clear 
all the detailed workup you have to complete on any method of analysis you use. 
Again, the exception is standard methods of analysis, such as ASTM methods, but 
most of the methods in a forensic laboratory will not be of that sort. You get even 
more detail on this point in the next element. 

5.4.5 Validation of methods 

5.4.5.1 Definition of validation... 

Briefly, method validation is the collection of objective evidence that a certain 
method of analysis actually does what you claim it does. It puts a useful focus on 
the matter if you ask: How do you know this method actually does what you claim 
it does? What supporting data do you have? For example, perhaps your lab claims 
to be able to identify illicit drugs. Obviously, you claim to have suitable methods 
for these tests. The question is, what objective evidence do you have that you can 
identify drugs reliably? As another example, perhaps your lab claims to be able to 
identify who signed a cheque. What objective evidence do you have that you can 
actually do that? These are large questions. There is more discussion in Chapter 7. 

Amplification: The elements of validation are stated. 

5.4.5.2. Details of method validation... 

The basic rule that the standard is trying to cover in these elements is that every 
method of analysis used in your lab has to be validated. If you can use standard 
methods of analysis, such as ASTM methods, you may not have to do nearly so 
much in-house validation work, because a great deal of the validation will have 
already been done by other labs. As long as you apply the standard methods 
exactly as they are published, you can rely on that work. However, if you modify 
such a method, or if you apply one in circumstances that were not considered by the 
scientists who originally developed it, you lose most of the claim to their validation 
evidence. Then your lab has to supply that evidence for itself. It’s the same thing 
if your lab develops a method strictly in-house, as previous elements specify. Once 
your validation is complete, do not forget to close off the record with a statement 
indicating that the method is fit for the intended use. 
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5.4.5.3 Validation meets customer needs... 

As mentioned previously, the standard emphasizes quantitative chemical or 
physical measurements. Although your forensic lab probably conducts some 
quantitative methods, most of the tests and examinations conducted in a forensic 
lab are qualitative. About all you can do to comply with this element is make sure 
your methods are giving results that are relevant to your customers’ needs, and 
write that in the method. Note 3 puts a balance of common sense to the validation 
requirement by bringing in costs, risks, and real technical possibilities. 

5.4.6 Estimation of uncertainty of measurement 

5.4.6.1, 5.4.6.2, 5.4.6.3 Details of uncertainty... 

Uncertainty of measurement is a very important point in ISO/IEC 17025:2005. It 
can be a fairly large topic in a forensic laboratory, too. You will notice that the 
weight given to uncertainty in the standard shows, once more, the origins of the 
standard, namely in quantitative physical and chemical measurements. At present, 
the position for forensic laboratories is this: for all of your quantitative methods, 
you must deal formally with the uncertainty of those measurements as required in 
the standard; for all qualitative methods, the concept of uncertainty of measurement 
does not apply. It might be a good idea for you to state this clearly in your lab’s 
policy. (See the discussion of uncertainty in Chapter 10.) 

5.4.7 Control of data 

5.4.7.1 Checking data... 

One “appropriate” way to meet this requirement is to have a second person (an 
independent reviewer) check calculations and data transfers, and then initial and 
date that transaction in the case file. There are probably other ways. 

5.4.7.2 Controlling electronic data... 

Compliance with this element is a matter of writing down things you are probably 
already doing. If you’re using commercial software, you can assume it has been 
validated. On the other hand, if you have written software routines in-house, such 
as spreadsheets that perform calculations, or databases that search for case-related 
information, be sure you have written down the steps you have taken to 
demonstrate that the programs are, in fact, doing what you think they are doing. 
Feeding in dummy data to make sure you get the correct output is one obvious way 
of doing this. 
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5.5 


Equipment 


5.5.1, 5.5.2 Suitable equipment and instruments... 

You must have equipment and instalments at hand that are capable of performing 
the forensic work your lab offers. Each instrument you use in case work has to be 
calibrated. So you must write a procedure for that calibration, perform the 
calibration at regular intervals, and record the results of the calibration. We see in 
this element, once again, the requirement that instruments have to be calibrated 
before they are used in casework. If you have to use “outside” equipment for your 
work, the same requirements for calibration and validation must be followed. 

This element applies not only to large pieces of equipment, but to smaller items like 
pipettors, so you may have a lot of work to do. The prospect of having to calibrate 
a bunch of pipettors at regular intervals may cause your colleagues to rethink how 
many pipettors they really need to use. It can be a useful exercise. 

Amplification: Laboratories are required to have an equipment maintenance and 
calibration program, and to include such items as microscopes, measuring 
instruments (e.g. chromatographs, refractometers, spectrometers, DNA 
sequencers). 

5.5.3 Authorization of equipment operators... 

The main ideas of this element have already been covered in earlier items, but let’s 
just reiterate. Operators have to be trained to operate equipment, the training has to 
be documented, and the operator has to be authorized in writing by a superior. The 
operating instructions (SOPs) must be easily available for the operator to use, 
which probably means located in a drawer alongside the instrument. 

5.5.4 Identifying equipment and instruments... 

Your lab may already assign a unique inventory number to pieces of equipment. If 
so, that’s all you need here. Pay attention, however, to small items, like pipettors. 
You will have to show that they, too, are calibrated. For this reason, you will need 
to identify each of them uniquely, as well. 


Introduction to Accreditation for Forensic Labs, Version 2.0 

© Murray Malcolm and Harold Peel 2005 Page 41 


Folk OIG PRR 111142 



5.5.5 


Inventory of equipment and instruments... 


The records outlined in this clause may already be contained in your lab’s 
inventory of equipment. Note carefully 5.5.5(f). The record of calibration may 
well be separate from the inventory because calibration, and checks of calibration, 
will likely be repeated at regular intervals. This suggests a logbook, rather than a 
single fde. 

You need to have a written calibration procedure and suitable records of it having 
been done. As the standard does not specify calibration frequency, think carefully 
about this in terms of the manufacturer’s recommendation and your usage of the 
equipment. While you are at it, consider any quick checks you want to have run 
between full-blown calibrations (a later element speaks of this). Finally, figure out 
a way to indicate unequivocally to all users whether an instrument at any given 
time is calibrated and ready for use, or not. This could be a dated green label 
saying “GOOD TO GO” that is stuck on the front panel of the mass spectrometer 
when it has been properly calibrated. It could be a small label on a pipettor reading 
“Date of next calibration is...Be sure there is a positive indicator so that no user 
is in doubt about the calibration status of an instrument. 

5.5.6 Maintenance of equipment and instruments... 

There is nothing very mysterious in this element: it merely directs you to have 
written procedures for the care and use of all your equipment. We believe there is 
an expectation that the maintenance program will be scheduled, not just applied as 
needed. 

5.5.7 Equipment out-of-service... 

Have a look back at what we said under 4.9. That was the element covering 
nonconformities and how you dealt with them. This element (5.5.7) concerns the 
same idea, except that it covers the situation in which something has gone wrong 
with a piece of equipment and, as a result, the accuracy of your test results may be 
in doubt. We suggest you use the same approach now. Identify the individual(s) 
with authority-the person who has the authority to stop testing, to recall reports 
already issued, to order that necessary repairs to equipment be made, and to order 
that testing resume once the problem has been fixed. 

Unreliable or out-of-service equipment must be labeled as such. Consider the use 
of another label, possibly a red one, reading, “Out of service - do not use.” Do not 
rely on word of mouth that certain equipment is out of service. This information 
has to be clear for all to see. 
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5.5.8 Showing calibration status of instruments... 

This has been partially dealt with in clause 5.5.5, but the standard uses the weasel 
phrase “whenever practicable” in this element. You should assume that the 
calibration status of all your measuring equipment has to be indicated to all users in 
a clear and unambiguous way. This may require some creativity on your part. 

5.5.9 Equipment out of the lab’s control... 

This clause refers to situations where your equipment has been borrowed or 
operated by someone who is not under your management system. In short, the 
equipment has been out of your control, for whatever reason. When you get it 
back, you have to ensure it is functional and calibrated before it is used again. 

5.5.10 Intermediate checks... 

Intermediate checks are ones carried out between regular calibrations. Obviously, 
they are done more frequently, and they are usually faster and cheaper. The idea is 
that you use the intermediate check to let you know whether an instrument’s 
calibration has drifted, for whatever reason (and calibrations do drift, as we all 
know). As an example, your lab may have decided to have your analytical balance 
calibrated once a year, and you have a written procedure for that. You may have 
decided, however, that in between calibrations, before every weighing on that 
balance, your analysts are to weigh a 10 mg weight and record the reading. That’s 
an intermediate check. This element tells you to write out and follow the procedure 
for checking this way. 

5.5.11 Correction factors... 

This requirement simply emphasizes that you need a written procedure for updating 
correction factors. 

5.5.12 Improper adjustments... 

Some ways you might use to safeguard equipment are: limiting access to certain lab 
areas only to specified people, using password protection on instruments and 
software, placing seals on certain adjustments, and applying the write-protection on 
calculations and methods in certain instrument-control software. 
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5.6 


Measurement traceability 


5.6.1 Calibrating equipment before use... 

This element may seem a bit redundant, but it emphasizes again the importance of 
having an established program for the calibration of measuring instruments that are 
critical to the test/examination result. All measurement results must be traceable to 
national or international standards, if it is possible to do so. In the details that 
follow, both calibration labs and testing labs are referred to, and sometimes it’s easy 
to get lost. It is significant that there is a specific focus on measurement standards 
and reference materials in the follow-up Note. It would be prudent to check with 
your accrediting body as to their policy for calibrating critical equipment. Some 
ABs require that calibration of critical equipment be done only by calibration service 
suppliers that are accredited to ISO/IEC 17025. 

Amplification: Check out instrument calibration after any type of shutdown. Use 
calibration standards with matrices matched to the sample, if possible. 

5.6.2.1, 5.6.2.1.1, 5.6.2.1.2 Details for calibration labs... 

Although this clause refers directly to calibration laboratories, you would be wise to 
read it thoroughly anyway because the over-arching principles will apply to a testing 
lab as well. You will see this connection in the next clause (5.6.2.2). The calibration 
of critical equipment/instruments must be traceable to national or international 
standards, if it is possible to do so. The required characteristics of an acceptable 
laboratory used for calibration and the content of the calibration certificate are 
outlined. Basically, this translates to using a calibration source (laboratory) such as 
NIST, or one that is accredited to ISO/IEC 17025:2005, for such reference standards 
as primary weights, thermometers, pipettes, and timers. Check the measurement 
traceability policy of the accrediting body with whom you are working. 

Traceability is discussed further in Chapter 9. 

Amplification: Instrument calibration should occur after any type of shutdown. 

5.6.2.2 Testing 

5.6.2.2.1, 5.6.2.2.2 Details for testing labs... 

This was discussed above. The Note reminds you that the extent to which 
traceability is applied depends on how much of the total uncertainty of the method 
may be due to uncertainty in the calibration. Unless you have this completely 
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calculated, it is best that critical equipment (e.g. balance, thermometers, pipettes) be 
calibrated by an officially recognized calibration laboratory or service provider. 

Amplification: Use calibration standards of brown purity and with matrices 
matched to the sample, if possible. 

5.6.3 Reference standards and reference materials 

5.6.3.1 Reference standards... 

The best example we can think of here is weights. Your lab probably has a set of 
high-grade weights. They need to be sent periodically for re-calibration to an 
accredited source that can provide evidence of traceability. Don’t use those 
weights for anything but calibration. 

In a forensic lab, you will almost certainly have devices for measuring temperature 
(e.g. thermocouples), volume (e.g. pipettors) and you may have some for measuring 
length (e.g. micrometers). The same considerations of calibration and traceability 
apply. 

5.6.3.2 Reference materials... 

If no certified reference materials exist, your lab should obtain the highest quality 
materials available and do some in-house testing to show the material’s suitability. 
For other materials used as standards in a forensic laboratory-such as paint, glass or 
ammunition-a complete record of the source material is the best you can do to 
demonstrate you have traceable control over the materials you are using as 
reference materials. 

Amplification: Requirements for full documentation, identification, and control of 
reference collections are emphasized. 

5.6.3.3 Intermediate checks 

This has already been discussed under 5.5.10. 

5.6.3.4 Transport and storage 

This element directs you to think about the storage of your chemical standards, for 
example. How are you going to show that pure chemicals have not deteriorated in 
storage? Do they have expiration dates? What about those same chemicals in 
solution? Do you run a mass spectrum on the chemical standard each time before it 
is used? Are safe handling and transport procedures in order? Is a WHMIS 
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program appropriate and in place? We urge you to think through such questions 
with your colleagues. 

5.7 Sampling 

5.7.1, 5.7.2, 5.7.3 Requirements for formal sampling plans... 

The concept of sampling can apply at several points in a forensic operation. If your 
laboratory is responsible for gathering crime scene evidence, sampling may become 
an issue. This element requires that you have a formal sampling plan for any such 
situation. 

Aside from crime scene work, it may be that, in some cases, the investigator will 
submit large quantities of such seized materials as drugs, soil, or questioned 
documents, and your scientists will be required to take representative samples of 
these materials for analysis. This process must be governed by a documented 
sampling plan. 

Of course, your lab may not control the sampling procedure at all, having to work 
with whatever the investigator chooses to submit. Even in that situation, however, 
you can still work within the spirit of the standard. You can document the 
limitations placed upon your analyses by the nature of the samples that were 
collected. Such information can be included in your methods of analysis and in any 
guidelines you provide to investigators. (For example, it matters a lot to the 
interpretation of toxicological results if the pathologist collected postmortem blood 
samples from the heart or from peripheral vessels.) 

Amplification: Documented procedures are requiredfor the selection and 
sampling of items received as exhibits from the investigator. Staff must be trained 
and competent in exhibit searching and sampling for their specialty area. 

5.8 Handling of test items 

As you study this element, ignore the phrase “calibration item” and remember that 
a “test item” is likely to be called an “exhibit” or “evidence” in a forensic lab. So 
this element describes all the requirements for handling exhibits in your laboratory, 
which you probably do already. 
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5.8.1 


Exhibit handling. 


Written procedures are required for all steps in the receipt, storage, and handling of 
evidence material. This applies to all your lockers, refrigerators, drying rooms, and 
receipt areas-in fact, everywhere you handle exhibit materials. In forensic labs, the 
procedures for exhibit return or disposal have to be carefully written. 

Amplification: An established chain-of-custody procedure must be in place, and 
include detailed records, such as unique identification for exhibits, appropriate 
dates of receipt and transfer, and identification ofperson(s) involved. Electronic 
tracking systems m ust be secure, capable of producing personal identifiers, and 
reproducible in hard copy. 

5.8.2 Identifying exhibits... 

This applies to your case-numbering system, whether manual or computer-based. 

In forensic terms, this element deals with the identity of exhibits and the chain of 
custody. Make sure both are impeccable. 

5.8.3 Suitability of exhibits for testing... 

Your lab may have informal ways of dealing with exhibits that do not match the 
description given on the request for analysis. If so, make them formal and write 
them down. Also, it is highly recommended that your colleagues write out 
acceptance criteria for the various sections. That is, you should describe the criteria 
that exhibits must meet before they will be accepted. The criteria often arise from 
validation work, as follows. 

As you were preparing the validation documents for each of your examinations, 
you and your colleagues had to decide and specify the conditions under which you 
demonstrated that the method worked as you claimed. As part of that thinking, you 
considered the flip side and stated the conditions under which you had evidence the 
method did not work, or conditions under which you had no evidence one way or 
the other. Some of the conditions you identified then were undoubtedly related to 
the nature, quantity, or condition of exhibits submitted. These exclusions can form 
the basis of acceptance criteria. Obviously, these problems would be discussed 
with the investigator, and records would be kept of the discussions. 
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5.8.4 


More on exhibit handling... 


This has already been touched upon in 5.8.1, except that there is a little more 
emphasis here on preserving the integrity of exhibit material. Once your laboratory 
accepts an exhibit, proper handling and storage are your responsibility. For 
example, if, as part of your quality process, certain materials have to be refrigerated 
or frozen, you have to monitor and record the temperature. Further, the 
thermocouple or thermometer used for monitoring has to be calibrated and 
traceable. Scheduled monitoring is useful to ensure there have been no equipment 
failures or electrical interruptions during which the samples could be destroyed or 
altered. 

A few of your colleagues may argue that, in some of these situations, the 
temperature does not have to be accurate-a “ball-park” value is all that’s needed; 
therefore, it should not be necessary to go to the time and trouble of calibrating the 
thermometer. This is not the proper conclusion. Rather, you will define the storage 
conditions depending on the particular samples (exhibits) being stored. You will 
use these conditions to establish the range of readings that is acceptable. It may 
well be that this range is rather wide (for example, any reading between 0 and 4C 
may be acceptable for a certain fridge). Even if that is so, you must use a calibrated 
thermometer to read the temperature so you can make a reliable judgement whether 
it meets your criteria or not. 

Amplification: Security procedures must describe measures taken during the 
testing/ examination process when evidence material is left unattended. Such a 
measure might be that evidence is secured in a limited access storage area. 
Similarly, packaged evidence (in transit, or temporary storage) should be properly 
sealed and initialed, unless each individual item contained in the package is sealed 
and identified. Sealed packages of evidence received at the laboratory must be 
initialed by the submi tting person. Each exhibit (evidence item) shall be uniquely 
identifiable, related to the unique case number. The image record of such things as 
latent prints and impressions shall be treated as evidence. When laboratory 
personnel collect evidence at a crime scene, appropriate procedures for continuity, 
preservation, and security will be followed. 

5.9 Assuring the quality of test results 

5.9.1 QC procedures... 

This element simply says that you must run controls in your examinations and 
record the results. The emphasis on quantitative measurements suggests using 
statistical procedures, if appropriate. We take this sentence to mean that you are 
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expected to use control charts, with statistically determined control limits, 
whenever you can. That applies to all your quantitative methods. 

For monitoring qualitative methods, you could use positive and negative controls (if 
that’s possible) and record the results. For examinations in which the concepts of 
negative and positive controls do not apply, other possible ways to establish quality 
control are listed. 

Amplification: Appropriate activities to monitor analytical performance include: 
reference collections, certified reference materials and those generated in the 
laboratory, statistical tables, positive/negative controls, replicate testing, alternative 
methods, repeat testing, spiked samples, standard additions, internal standards, and 
independent checks. Regular participation in proficiency testing programs, using 
the laboratory ’ s approved methods, with follow-up corrective actions and complete 
records, can be used. The accrediting body may specify which proficiency test 
providers are acceptable, and the frequency of individual and/or discipline 
participation. Regular monitoring and evaluation of testimony in court of each 
examiner is required, with remedial training provided if needed. Prior to release of 
a report, an administrative review of the case file shall occur. 

5.9.2 Using QC data... 

This is a new clause in the 2005 revision, and there is very little mystery 
surrounding it. It simply says that, if you run controls you have to pay attention to 
the results and take action on what they tell you. We just suggest that you note the 
use of specific words: pre-defmed criteria and planned action. You need to have 
written those criteria, and described the actions, in advance. 

5.10 Reports 

5.10.1, 5.10.2, 5.10.3, 5.10.4 Contents of the test report... 

Once more, you have to sort out the requirements for a testing lab and a calibration 
lab. Mostly, this element is clear enough. Clause 5.10.2 lists all the information that 
is expected to be in your lab report. If your laboratory chooses not to include one or 
more of the points listed, you need a “valid reason” for the omission, and the reason 
must be stated in your procedure for generating reports. Don’t just leave out items 
without explanation. 

Amplification: Three options for meeting this requirement are suggested in 
amplification documents. First, you may simply include in the Test Report all the 
information required by the standard. Second, you may prepare an annex to the Test 
Report that includes any information required by the standard that has not been 
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included in your Test Report. Finally, you can ensure that the information required 
in 5.10.2 of the standard can he found in the relevant case record. 

Release of case report information shall follow the laboratory’s established 
procedure. 

5.10.5 Opinions and interpretations... 

In most forensic work, the interpretation of test results, or the assessment of the 
forensic significance of certain findings, is the whole point of the exercise. The 
basis for your reported opinions has to be documented, but may not have to appear 
in the test report itself It is usually sufficient for that documentation to be 
contained in (or referenced from) the case file. 

If your examiners provide test results over the phone, for example, make sure the 
essence of those conversations is recorded. (See Note 3.) 

5.10.6 Testing results obtained from subcontractors... 

It is clear from the earlier discussion of subcontracting that your lab is completely 
responsible for all the work it subcontracts and that your customers have to be 
informed when any of their work is contracted out. Furthermore, if you include the 
subcontracted results in your lab’s test report, those results have to be identified in 
the report. 

5.10.7 Electronic transmission of results... 

Your SOP for reporting test results should state how the reports are prepared and 
distributed electronically. 

5.10.8 Format of reports and certificates... 

Your lab is probably in compliance with this element. However, this might be a 
good opportunity to review the format of your lab reports, looking for clarity of 
presentation. 

5.10.9 Amendments to test reports... 

You may have dealt with this already in the procedure you wrote back at 4.9. 

When something goes wrong and the accuracy of a test result is in doubt, it is 
necessary to issue an amended report. This element makes that explicit: another 
report is to be issued, containing a clear statement that it is an amended report and 
that it replaces the one issued originally. 
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Chapter 3. What Does “Quality” Mean in a Forensic Lab? 

When you look through the general literature on quality assurance (QA), you will find 
that there is no single definition of quality. In fact, there is an almost bewildering assortment 
of descriptions and definitions. Most of them have been written with manufacturing or 
service industries in mind, and often there appears to be no clear connection to a laboratory 
operation, especially a forensic lab. To get the feel for it, it is a worthwhile exercise for you 
and your colleagues to struggle with some of these ideas, to see how they apply to your 
operation. We think you’ll find that the discussions and debates will offer useful insights 
into who your customers are, what your relationship with them is, why your management 
system is important, and how you can provide an improved service. 

Many of the definitions have always struck us as, somehow, bland. Quality has been 
defined as “meeting specifications,” “meeting requirements,” “meeting expectations,” and 
“fitness for purpose”. These phrases are undoubtedly correct, but not very sharp. We think 
it is worthwhile to work with your colleagues to establish your own definitions and policies, 
or perhaps to adapt definitions used by other organizations for use in your laboratory. 

To begin, no matter how your forensic laboratory is organized, it is useful to think of it as 
a business that offers testing/examinations in a number of highly specialized areas. The term 
“business” may have some limitations if your laboratory is part of a police department or a 
government agency; but, for now, think of it as a business. 

What is your lab’s product? Some will say “data;” some will say “information;” and 
some might say “forensic interpretation.” In the end, however, probably most would agree 
that the Laboratory Report is your primary product. Certainly that’s the view ISO/IEC 
17025:2005 takes in its section on the Test Report. 

All right, next question: how do you define quality in a Test Report? How would you 
recognize it? What features would you expect? 

We have been through this exercise several times. Inevitably, after some discussion, we 
have settled on one feature of the Test Report as being crucial: accuracy. If the results of 
forensic analyses and examinations are not accurate-in the usual sense of being close to the 
true value or interpretation-it is not a high-quality report. Period. 

Our discussions of quality of the Test Report have always raised other features, as well. 
Consider timeliness, for example. Obviously, a lab report that is late might be useless to 
your customer because of that fact alone. It is not helpful to your customer if the report 
arrives after the case has gone to court and been disposed of. Obviously, turnaround time is 
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a very important feature of your service and could be part of your policy on quality. That’s a 
question only your lab can decide. 

And what about clarity? A laboratory report that is both timely and scientifically 
accurate, but so full of jargon and acronyms that the customer simply cannot understand it is 
not a high quality product-it’s junk. One could argue that both accuracy and timeliness have 
been wasted. The forensic scientist has to be able to explain his or her findings to a judge 
and jury in understandable terms. The test report should be prepared with the same care. 

Our discussions on quality have often got complicated, as we’re sure they will in your 
lab, but ours always came back to this foundation statement: 

In a forensic laboratory report, quality is accuracy. 

There is another angle to the quality question, too, and it’s important to raise this point 
here. The QA literature primarily speaks to manufacturing and service industries, and 
writers are practically unanimous that the customer defines what quality is. The experts 
(such as Tom Peters, for example, in Thriving on Chaos) are quite clear on this. In this view, 
it does not matter what you, as the manufacturer, think is quality in your product. Only if 
your product meets your customers’ definition-only if your customer is delighted -can you 
claim you have a high quality product. You will know how highly your customers rate your 
product because they vote with their dollars. If you are a manufacturer, it is tough to 
disagree with this line of argument. However, we do not believe it can apply totally to the 
situation in forensic laboratories. Here’s why. 

In a forensic laboratory your immediate customers are probably law enforcement 
personnel and members of the legal community. However, most forensic labs can be seen as 
serving the wider common good, not just the immediate needs of the police investigator at 
the lab’s door. Your laboratory is in the business of providing all your customers with 
scientific/technical data and interpretations that most customers are probably incapable of 
evaluating for themselves. Also, most of the time, the customers may not be interested in the 
test result as such, but want to be able to understand the forensic significance of that test 
result. For example, investigators do not really care about the scientific details of a DNA 
analysis; they want to know whether an exhibit from a crime scene can be linked to a given 
suspect. Strictly it is not their business to worry about how the link was made; that is the 
lab’s job. Similarly, prosecutors are mainly focused on what the Lab Report can do to help 
make a case, and they-like the investigators-have to rely on the interpretation provided by 
the lab. Both of these customers will be “delighted” by a lab report that simply does what 
they want done: link to a suspect or help make a case in court. It is very easy for forensic 
scientists to slide into the attitude that their duty is to provide whatever information will 
“delight” customers, no matter how that information was obtained. This has led to instances 
in which forensic scientists overstated the significance of test results, even falsified test 
results, in the interest of “delighting” their customers. These were not proud moments in the 
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history of forensic science. Consequently, our discussions have always concluded that the 
definition of quality in a forensic lab report could not be left entirely to customers, but has to 
be defined in the first place by scientists. 

In summary, everything that affects accuracy must be determined by scientists only. On 
the other hand, factors such as timeliness and clarity of the test result are best worked out in 
consultation with the primary customers. ISO/IEC 17025:2005 covers both the scientific 
requirements as well as points of customer service. 
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Chapter 4. What Do You Have to Do? 


The steps to becoming an accredited lab can be stated quite briefly. You first need the 
assurance that your senior management supports implementation of a management system that 
can be accredited to a recognized standard, such as ISO/IEC 17025:2005. Then you prepare 
your lab by making sure that your operation covers off every requirement in ISO/IEC 
17025:2005 that is applicable. Don’t presume that you can ignore difficult requirements; you 
will be audited to every element in the standard. 

Once you have your management system fully operating and under control, you apply to 
the accreditation body you have chosen to work with. You pay your fees and provide copies 
of all the documentation your accrediting body demands. After reviewing your application 
materials for completeness, the accreditation body arranges, with your concurrence, for a Lead 
Assessor and Technical Assessors, and suggests a proposed date and schedule for your lab’s 
initial assessment. When the assessment visit is completed, the Team Leader will provide you 
with an audit report containing a list of the items your lab has to address. Once your lab has 
provided satisfactory responses to the audit findings within a specified period of time, you 
will receive a certificate of accreditation. 

The above brief outline is a start, but it is not very concrete, especially on the first point 
“prepare your lab....” The decisions whether to become accredited and how to start into it can 
be the most difficult ones. After you have become somewhat familiar with ISO/IEC 
17025:2005 and have decided to seriously consider accreditation, the following suggestions 
may be of use: 

• Compare the policies, procedures, and activities currently used in your laboratory with 
the managerial and technical requirements of ISO/EEC 17025:2005. If you are aiming for 
accreditation under an amplified forensic specialty area, you would obviously use any 
supplemental material as well. Depending on your familiarity with the standard(s), you 
could conduct a gap analysis yourself, or hire a consultant to do one for you. 

• Develop an implementation plan that determines what has to be done, who can be 
assigned to the project, training required, time lines, and estimated costs. 

• Carefully look at your current policies and objectives in regards to your services and the 
management system to support them. It is from here that the scope of tests/examinations, 
procedures, and support activities will be determined. This is a combined activity with 
senior management. 

Even these suggestions, however, were not sufficiently concrete in our experience. 
Colleagues would get impatient and demand, “Never mind all the discussion, just tell me 
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what to DO.” In response to this we prepared a checklist, shown on the next page. Be 
warned: this checklist does not contain everything you need to do, but you will have to do 
everything on the list. So, if your technical people are champing at the bit to get started, 
nobody will be wasting their time working on the items in this checklist. 

This list will keep people busy for a while. As these documents are generated, several 
additional questions, such as format, will arise. We’ll deal with those questions in later 
sections. You should have your new management system in operation for some months 
before you apply for accreditation. That probably means having been through a cycle of 
proficiency tests, internal audits, and a managerial review before the accreditation visit 
occurs. 


Introduction to Accreditation for Forensic Labs, Version 2.0 

© Murray Malcolm and Harold Peel 2005 Page 55 


Folk OIG PRR 111156 



A Checklist for Starting to Prepare Your Lab for Accreditation 


_Make a list of all the positions in your lab along with a current job description for 

each one. 

_If you don’t already have one, make an organizational chart for your lab; if you do 

have one, make sure it is accurate. 

_Document the policy and procedures that gives each manager the authority and 

resources to carry out their duties. 

_Document the policy that makes sure lab personnel are free from commercial, 

financial, or any other pressures that might adversely affect the quality of their work. 

_Identify your technical management, i.e. the person, or persons, with overall 

responsibility for the technical operations. 

_Identify the quality manager, i.e. the person responsible for the management system 

and its implementation. 

_Identify deputies to stand in for all your managers and supervisors, and write policy 

covering when and how this substitution is to occur. 

_List all the tests/examinations carried out in your lab and write a separate Standard 

Operating Procedure (SOP) for each one. (We’ll deal later with the details of what 
should be included in SOPs.) This list of tests and examinations will be the basis of your 
Scope of Accreditation. 

_List all the equipment used in your lab and write procedures for the operation, 

calibration, and maintenance of each one. 

_List all the proficiency tests done in your lab. Include the names of people who did 

the tests, those who evaluated the results, the dates on which everything was done, and 
the results of the test. 

_Describe the security procedures in your lab. This includes security of the building 

itself as well as details of the proper receipt, storage, handling, and disposal of exhibits. 

Provide orientation to the standard for all lab staff. 
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Chapter 5: The Quality Manual 

Sometime in the early stages of preparation, you will have to write the document that 
describes your management system. You can call it your Management System Manual, or 
the Quality Manual (QM), or the Guide to Quality Operations, or whatever. It’s your 
preference. This manual is not optional. You must have a QM that addresses all the parts of 
ISO/IEC 17025:2005. It would be handy to have the QM available as a guide for all the 
preparation activities. It is impossible, however, to think of everything until you have been 
through the whole process, so consider the QM an evolving document and structure it 
flexibly in the initial phases of development. Nonetheless, you have to start somewhere. We 
suggest you begin sketching the manual out now, writing rough drafts as you and your 
colleagues work your way through various parts of the preparation. Initially, the whole idea 
of a Quality Manual may be something of a mystery. If you have never seen one, you may 
have no clear idea what it is supposed to contain. So let’s back up, and touch some of the 
basic definitions and ideas. 

To begin with, the Quality Manual is a document that describes your lab’s Management 
system. Think of it as an index or a roadmap to your Management system. The Management 
system is the collection of all the things your lab does to assure the quality of its product. If 
you accept our earlier argument that “quality is accuracy,” we can state this even more 
specifically. The Management system is made up of policies, management procedures, 
analytical methods, peer reviews, and quality control procedures. It includes everything you 
do in your lab to make sure that your customers always receive an accurate Test Report. Just 
as we suggested a checklist of activities to get your colleagues started, we offer another one 
now for your Quality Manual. 

Keep in mind that your written documentation has to describe how you operate your 
laboratory and conduct tests and examinations. You can think of your quality documents as 
fitting into a hierarchy as follows: 

1. At the top is the Quality Manual. It includes a general description of your 
management system, policies, and objectives, and why things are being done 
(with complete reference to other manuals). 

2. The next level contains the documentation of all your Quality Procedures. 

These include standard operating procedures (SOPs), such as those for 
administrative procedures or technical procedures, which provide details of who, 
what, when and where. Closely linked are Instructions, which are even more 
detailed (e.g. specific technical methods, equipment instructions for operation and 
maintenance, and so on.) Because any Forms your lab uses are really abbreviated 
Instructions, they must be part of the quality document system as well. 
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3. To demonstrate that all of the above procedures are being followed in your 
lab’s operation, the overall quality documentation system is supported by 
Records, which are dealt with as a separate requirement in ISO/IEC 17025:2005. 

We can infer from sections 4.1 and 4.2 (and others) of the standard, that your Quality 
Manual must cover these points, either directly or indirectly: 

- a policy statement from top management about the lab’s commitment to quality, 

- an organizational chart of the lab and of the parent organization, 

-job description outlines for all key positions, 

- identification of staff with signing authority, 

- a list of all analyses/examinations offered by the laboratory, 

- procedures for achieving traceability of measurements, 

- procedures for reviewing lab resources before taking on new work to make sure 
the lab can do the job, 

- procedures for handling exhibits, 

- a list of all major equipment in use in the lab, 

- details of proficiency tests used in the lab, 

- procedures to be followed in the event of testing discrepancies or departures from 
documented policies, 

- procedures for allowing departure from documented policies and procedures or 
from standard specs, 

- procedures for dealing with customer complaints, 

- procedures for protecting confidentiality and proprietary rights, 

- procedures for audit and review. 

OK, now take a deep breath, relax, and give this some thought. First, the term “quality 
manual” implies a single entity, one binder perhaps, containing all that material. 


Introduction to Accreditation for Forensic Labs, Version 2.0 

© Murray Malcolm and Harold Peel 2005 Page 58 


Folk OIG PRR 111159 



You need to consider the organizational structure of your lab. Is it a standalone, or is it 
part of a larger organization? What tests and examinations do you offer? In which forensic 
disciplines? What sections or departments are included in your lab? If your lab is small (a 
three or four-person establishment, say, offering 3 or 4 analyses), it is conceivable that you 
might be able to write a single manual that would include in one binder all the elements of 
your Management system in as much detail as you finally need for procedures and 
instructions. This can be done, but it makes it hard to revise the manual. 

If your lab is larger, we suggest that you think of a hierarchy of manuals and other 
documents, as suggested above, with the Quality Manual you are presently working on as the 
senior quality document. In that position it has to cover all the elements of the quality 
standard-no doubt about that-and it might set the pattern for all the documents under it. By 
that, we mean you can write a brief description in the Quality Manual covering one of the 
requirements of the quality standard, then refer the reader to a separate document that deals 
with the requirement in greater detail, if that’s necessary. Let us give you an example in the 
area of the traceability requirement. 

ISO/IEC 17025:2005 requires that all critical measurements made in the lab be traceable 
to an international or national standard, whenever it is possible. Let’s assume that you have a 
Trace Evidence Section which uses an analytical balance, and a Biology Section which 
monitors the temperature of an exhibit freezer. Measurements from both the balance and the 
thermometer have to be traceable; but, the details concerning exactly what has to be done, on 
what schedule, and by whom, will likely be quite different in the two sections. It would, of 
course, be possible to write all the detail into the Quality Manual, however, that’s probably 
not the best way to go. It would be more sensible to put an over-arching statement in the 
Quality Manual. Here is an example. 

“All measurements are made on instruments that have been calibrated before being used in 
casework, using standards that are traceable to national or international standards. The 
program for calibrating equipment and providing traceable standards includes selection 
procedures and maintenance schedules. All materials that are not traceable to national 
standards used in forensic testing and examinations are properly documented and maintained 
to ensure their identity and integrity. Other specific details are included in the appropriate 
section procedure manuals, as needed. ” 

What such a statement obviously does is call into existence a whole new class of 
documents, one or two levels down in the hierarchy, which we could call Standard Operating 
Procedures (SOP) and Section Documents. These documents might be contained in a Section 
Manual. So, in our example, the Biology Section Manual might contain a SOP for the freezer 
and the Trace Evidence Section Manual might contain another one for the balance. Both SOPs 
would connect to the general statement in the QM. In any case, this is something that you 
have to decide. The accreditation standard does not dictate this arrangement. So lay out a plan 
for your documents in a way that makes sense for your lab. 
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Let’s carry on, then, with the idea that you will create a hierarchy of manuals and 
documents that describe your Management system in its entirety. The Quality Manual that 
you are considering now will be fairly brief. It will describe the “big picture.” It will be a 
reasonably concise statement of your lab’s approach to quality in its work. It will state, in 
broad terms, how your laboratory meets each requirement of ISO/IEC 17025:2005. It will act 
as an index, showing where the detailed policies or procedures covering one requirement or 
another are to be found. This works even if your lab is part of a larger organization. 
Undoubtedly, some elements of the accreditation standard (such as policy and procedure on 
training, for example, or policy for retaining lab records) may already be detailed in the 
documentation of your parent organization. Whenever that is so, you need only place a 
reference to that documentation in your Quality Manual. 

As you move down in the hierarchy of documents, it should be clear to you that there are 
two implicit assumptions. First, the higher the level of document, the more general its 
wording and the broader its application. Once set down, the wording of documents at this 
level is changed the least. Naturally, lower level documents will be more detailed, more 
specific to a single activity or discipline, and can be more easily changed to meet the normal 
advances in techniques. 

The second implicit assumption is that a lower level document can amplify, and make 
more specific, the items in a more senior document. It must never contradict the senior 
document, however. Obviously this must be so, if you are not to have total chaos in your 
organization. We suggest you consider stating this principle quite explicitly somewhere in 
the Quality Manual, nonetheless. 

Another question that you must think about while you’re considering what manuals you 
need is document control. ISO/IEC 17025:2005 has a lot to say on this topic and, for that 
reason alone, you are well advised to get a grip on it sooner rather than later. As a purely 
practical matter, as well, you need to be on top of your lab’s documents. We can’t think of 
any other single area in which things can so quickly spin into chaos and in which you can 
spend more time trying to fix problems. Solid planning at the beginning is important, so 
important that we’ll devote a note later to the ideas of document control alone. 

Finally, you want to think about format. This may sound like a frill, but we don’t believe 
it is. The idea is that the documents you write are not for show. They are supposed to be 
used in your day-to-day lab operations. That’s the point of them, and that’s definitely what 
ISO/IEC 17025:2005 assumes. It is much more likely that they will be used if they are easy 
to access, simple to read, and pleasing to the eye. 
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Chapter 6. Document Control 

We suggested above that you plan early to maintain control of your documents. The word 
“document” applies to all the manuals, SOPs, worksheets, and forms that you use in your lab. 
The word “control” refers to all the steps you must take to make sure that no unauthorized 
document is ever used. This is where things can get complicated, so let’s break it down. 

First, whatever the document is, these items of information have to appear on it: 

■ It has to bear a unique identifier. This can be a name or a number, some 
combination of name and number, or any other designation you like. It must, 
however, distinguish unambiguously a particular document from all others. 

■ It has to show the revision number and/or the date of revision. This is important 
because the over-arching requirement is that only current documents are used in your 
lab. 

■ The pages have to be numbered using the “X of Y” format. 

■ It has to identify the authority who approved the document for use. This can be 
placed on a cover page of the document. 

Second, all your documents are subject to certain control procedures that you have to 
specify, probably in your Quality Manual. For each document you use in your lab, you must 
cover off these specific points of document control: 

■ State who is authorized to approve the document for use. Of course, in an overall 
sense, your Director approves all documents, but you are looking for the individual 
who actually signs off the document. 

■ Describe your lab’s policy respecting controlled and uncontrolled copies. In this 
context “controlled” means your lab accepts responsibility for sending out 
amendments and keeping the issued copy up to date. “Uncontrolled” means you are 
not responsible for such action, and the document has to be clearly marked as such. An 
example of the use of an uncontrolled copy would be the situation in which a lab 
supplies a customer with a copy of their Quality Manual as promotion or information 
about the lab’s operation. We think that any use of uncontrolled copies of procedures 
or methods within the lab is an invitation for chaos and should be strongly 
discouraged. 

■ Describe the procedure for ensuring that the document is reviewed periodically and 
revised, if necessary. The review is intended to make sure that the document is still 
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suitable for its intended purpose. You need to specify who does the review (usually 
the same person who authorized the document in the first place) and how often (once a 
year is a rule of thumb, but you could make a case for less frequent reviews for some 
documents). 

■ Describe how reviews and revisions are recorded. This record should show what 
change was made to the document and the date. The procedure should include 
provision for an entry in the record showing that the document was reviewed as 
scheduled, but-as is often the case-no revision was required. 

■ Describe your procedure for archiving outdated versions so that they can be 
retrieved when necessary, but cannot be used inadvertently in current lab operations. 
(Outdated hard copies might be stamped “Archive” in red ink, for example.) 

Finally, the question must arise whether your documents are paper, or electronic, or some 
combination of the two. This question has already been answered, at least partly, by the day- 
to-day practices in your lab. Historically, of course, all documents were paper, and ISO/EEC 
17025:2005 sounds as if it was written with paper documents foremost in everybody’s mind. 
Increasingly, one sees more and more lab documentation (such as instrument output) as 
electronic files, but there are very few completely paperless lab operations. Typically, you 
will be dealing with some combination of electronic and paper documents, having to control 
the lot according to the requirements of ISO/IEC 17025:2005. Exactly how you do this will 
depend upon your lab’s needs. Here are a few thoughts. 

A common approach is to declare in your Quality Manual that the electronic version of 
each document is always considered the authoritative version. This is a good strategy 
provided you make sure that this master copy is protected from inadvertent or intentional 
tampering or erasure. There is proprietary software that does all the filing, version control, 
logging of alterations to the text, and so on. You will need to check out these packages for 
yourself, but we will note one thing: with some packages, the format of the pages they 
generate is spectacularly ugly. As stated earlier, for control purposes, you have to place a 
fair amount of information on every page of every document. This information can clutter a 
page badly, if you let it. Careful design of headers and footers, judicious selection of font 
and font size, and the inclusion of ample white space, can avoid a truly ghastly page layout. 
Ignore all software packages that impose inelegant document formats. 

All right, let’s assume that you have declared the electronic version of your Quality 
Manual (for example) to be the authoritative version. Still, it is almost a certainty that you 
and your colleagues will want a few hard copies. As these hard copies should be controlled, 
you have to decide exactly how many copies you will produce every time there is a revision, 
and maintain a record of their distribution. It’s useful if the signature and the numbering are 
in some ink colour other than black, so you can distinguish bootleg photocopies. You pretty 
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well have to declare all un-numbered copies forbidden. When a revision is issued, print the 
new copies, number them and distribute them in exchange for the obsolete ones. 

By comparison, if you declare all hard copies uncontrolled, it might appear at first glance 
that you save yourself some time. After all, any revision to the manual will be done to the 
electronic copy, and that’s easy. You then notify everybody in your lab that there is a new 
version of the manual available on the network, and advise that all outdated copies are to be 
taken out of service. If copies are printed, there can be an automatic designation that it is an 
uncontrolled copy. And your job is done, right? Well, maybe. 

Let’s assume you revised the manual four times in the past year. At year’s end, we 
would bet that you would be able find hard copies of all four revisions somewhere in your 
lab. All the things that could go wrong with your revision procedure would go wrong. Some 
people would not receive your notice of revision; some would receive it but do nothing about 
it. Some would print a copy of the new revision, but not destroy the old one. To save paper, 
some would print only the pages on which changes appeared and staple them into the 
previous revision. And so on. When you consider all the time you’d have to spend on 
search-and-destroy missions for outdated hard copies, you may conclude that tight control of 
hard copies is the preferred course of action. 
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Chapter 7. Validation of Methods 

Method validation is a large topic in forensic science, and in some specialties, it’s an 
uncomfortable topic. However, ISO/IEC 17025:2005 is quite clear: all the methods you use 
to analyze crime scene samples or exhibits must be validated before they are used. So let’s 
look at some of the issues that this requirement raises. 

To begin with, it helps to be clear about what method validation entails. Fundamentally, 
validation is the evidence that a given analytical method actually does what you claim it 
does. Please understand that we are talking about hard data here: documented, objective 
evidence that was obtained in your laboratory, or someone else’s. Statements of belief, 
wishful thinking, or testimonials that “we have done the examination this way for twenty 
years” do not constitute validation data. 

You have seen that ISO/IEC 17025:2005 refers to a spectrum of method types, including 
standard methods, lab-developed methods, and so on. These differ in the amount of 
validation data your lab has to generate for itself. For example, if your lab uses a standard 
method (and here we mean a Standard Method, such as might be published by ASTM, or a 
similar body), much of the validation of that method has already been done. The work has 
been carried out and the data has been collected by a number of other labs in collaborative 
studies. Your lab is entitled to rely on that objective evidence, as long as you apply the 
Standard Method exactly as it was published. Your lab would have to generate a relatively 
small amount of data internally to confirm, or verify, that you are actually able to make the 
Standard Method work successfully in your organization. 

If your lab modified a Standard Method significantly, you would lose claim to the 
published validation evidence and would, therefore, have to generate more of that evidence 
within your own lab. There can be endless debate over what constitutes a significant 
modification; but, you should recognize that the greater the deviation from the Standard 
Method, the less you are able to rely on published validation evidence, and the more you will 
be expected to generate that evidence within your own lab. 

In the case in which you are intending to use a method published from a peer-reviewed 
scientific journal (eg. Journal of Analytical Toxicology ), you have to supply a lot more 
validation data from your own lab. Such a method certainly has been validated to some 
degree, but not to the extent that a Standard Method has. The method is considered to be an 
unofficial method and validation in your lab is required. 

At the other end of the scale is a method that you develop from first scientific principles 
within your own lab. This is probably more common in forensic science than other testing 
laboratories, because of the nature and condition of forensic samples. Such a method has not 
been validated by any other laboratories; it has not been published in the literature. You have 
simply developed the method to meet a need in your particular circumstances. (By the way, it 
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is quite all right to do this-ISO/IEC 17025:2005 merely singles out such methods because 
they have to be handled a little differently.) As you might expect from the continuum 
suggested above, all the validation evidence has to be supplied by your lab. When you look at 
the details of the standard, we think you will see that the items listed can be understood most 
easily in the context of a quantitative chemical analysis. So, let’s use the quantification of 
ethanol in whole human blood as an example. 

To begin with, you will have the new method written out so everybody can follow it. 
You’ll check out the instruments you plan to use, making sure that they’re working according 
to manufacturer’s specifications. You will secure a supply of certified ethanol standard and 
prepare suitable dilutions for use. The balance, the dilutor, and the pipettors you use will all 
have been calibrated so that measurements made with them are traceable to a national or 
international standard. By the way, ethanol is an unusual drug in that it is available as a 
reference material from NIST. 

The validation work would consist mostly of preparing a set of standards, covering 0-500 
milligrams percent ethanol, for example; analyzing them; and plotting the results. You can 
think of the calibration curve as objective evidence that your ethanol method actually does 
what you claim it does. Is a single calibration curve all you need to validate the method? 
Probably not. You will need to know how well results can be replicated run-to-run and day- 
to-day and to record the stats that show this. In so doing, you will have repeated the 
calibration curve a number of times. You will have calculated how precise the method is; you 
will have assessed the linearity of the curve; you will have determined LOD and LOQ. 

We expect you would also need evidence of the effect of the matrix, for example. That is, 
does it matter whether the calibration standards are prepared in water or human blood? How 
do blanks behave in this method? Do blood samples that are known to contain no ethanol 
actually give zero signal? And so on. 

In a forensic application, it might be useful to know if the method gives reliable results 
for ethanol in serum, or in urine, or in vitreous fluid, as well as in whole blood. Of course, 
you cannot simply assume that it works with those fluids; you have to run it and collect the 
objective data. And what of decomposed samples? What about other volatile compounds 
besides ethanol that might be in the samples? Do they interfere? The list of questions can go 
on. Our point is to illustrate the sort of objective evidence that you would have to collect to 
show that your ethanol method is valid. This also illustrates that validation may be an on¬ 
going process in which you expand, through objective evidence, the circumstances under 
which you know the method works (or doesn’t). For example, you might choose to limit the 
application to samples of whole blood only. In that case, you would never have to collect 
evidence of your method’s behaviour with serum, plasma, or urine. This sort of limit is 
alluded to in the standard. 


Introduction to Accreditation for Forensic Labs, Version 2.0 

© Murray Malcolm and Harold Peel 2005 Page 65 


Folk OIG PRR 111166 



The above discussion deals with validation of a method you developed in your lab-a 
conventional, quantitative, chemical analysis. There are comparatively few of those, 
however, in a forensic lab. What about less conventional examinations? How can they be 
validated? 

What about qualitative chemical analyses, such as the identification of illicit drugs, or the 
detection of fire accelerants, or the chemical identification of cosmetics and lubricants? 
Validation evidence in these situations is quite straightforward. Many of the technical items 
that you would cover for a quantitative analysis (mentioned above) would also apply in 
qualitative analyses. For example, you would still be making sure instruments were properly 
calibrated; you would still be considering possible interferences; you’d still be exploring 
matrix effects. Limit of detection might still be an issue. There may be other points you need 
to consider, as well. 

What about less conventional examinations? Consider a method such as comparing a 
bullet with a given firearm. Your lab claims that this method is capable of determining 
whether a specific bullet was fired from a certain firearm or not. How do you validate this 
method? Almost none of the points listed in the earlier example apply here. There is no 
standard reference material; there are probably no measuring instruments to be calibrated; 
questions such as linearity and interfering substances are practically meaningless. There are 
several other common forensic examinations that present similar problems: handwriting 
comparison, tool mark examinations, physical matches, and so on. With methods of this sort, 
you have a limited number of factors that you can use to provide the objective evidence that 
these methods actually do what you claim they do. Here’s what we think is possible. 

You can gather the published work-all the scientific papers, for example-that supports 
your method. You can show that your examiners are properly trained and tested. You can 
show that they all follow a detailed, written examination protocol. You can show that they 
peer-review one another’s work. You can show that they all successfully perform 
proficiency tests. And that’s about all there is. Of this short list, we consider proficiency 
testing the most powerful indicator of method validity; and because there is so little other 
validation evidence available for these examinations, this may be a reason to increase the 
frequency of proficiency testing in these areas. This is something for your lab to decide. 
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Chapter 8. Standard Operating Procedures (SOPs) 


A Standard Operating Procedure (SOP) can be defined as a procedure that specifies how 
to do some operation in your lab so that everybody who performs that task does it the same 
way. By “operation,” we mean to include methods of analysis and examination, and 
administrative procedures as well. The standard does not prescribe any particular format, so 
the question is: what should the SOP contain? 

First, SOPs are subject to your document control policies and will bear the unique 
identifier, the revision number and/or the date of revision, numbered pages in X of Y format, 
and the approving authority. 

Second, the main point of an SOP ought to be the work instructions or procedure. To 
clarify the difference between these two levels of documents, a procedure describes the way 
an activity is performed (e.g. “General Maintenance & Repair of Instruments/Equipment in 
the Biology Section”); whereas, the associated work instruction provides detailed 
information on how to conduct the procedure (e.g. “Maintenance of Thermocycler, Model 
xx”). We suggest you simply write these instructions as a series of numbered steps. Write 
the steps at a level of detail such that any person trained in your discipline could follow your 
SOP in your laboratory; and, if they did so, they would have carried out the procedure 
correctly and completely. Include here any criteria forjudging whether or not an exhibit is 
suitable for examination. Be prepared to take several passes at writing an SOP. Try out each 
version with a colleague to make sure that the instructions are clear and complete. 

Finally, with that done, we suggest there are several other headings that you might want 
to include as part of the SOP. (Although these are not required by the standard, they provide 
a uniform and technically credible structure to your documents.) The headings are listed 
below, along with a brief description of the information that would be included under each 
one. Some examples for use in managerial or technical SOPs are given. 

Scope: Provide a description of where this SOP is to be used and, if appropriate, where it is 

not to be used. Example 1 (technical) : “This SOP covers quantitative analyses of 
ethyl alcohol in whole human blood, whether it is a postmortem sample or one 
drawn from a living subject. It can also be used in analysis of urine or vitreous 
humour. This SOP cannot be used in the analysis of ethyl alcohol in cosmetics, 
industrial chemicals, or alcoholic beverages, whether commercial or homemade.” 
Example 2 (managerial) : “This Procedure describes the process for handling and 
documenting complaints received from customers and laboratory personnel.” 
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Responsibility: State who is authorized to carry out the SOP. Example 1 (technical) : 

“Personnel in the toxicology section who have successfully completed 
training are... Example 2 (managerial) : “All personnel who receive a 
complaint shall “The Quality Manager is responsible for...”; “The 
Section Head is responsible for ...” ; “The Director is responsible for....” 

Associated SOPs: Use this heading to cross-reference any other SOPs needed. Example 1 

(technical) : A reference might be made to the SOP for operation of an 
instrument used in the present method. Example 2 (managerial) : A 
reference could be made to another procedure for corrective and 
preventive actions. 


Definitions: If there are any terms needed in this particular SOP, and those terms are 

not listed in any manual or standard, define them here. 


Safety: If there are hazards unique to this SOP, list them here. If there are special 

precautions to be taken or protective gear to be used, this is where they are 
described. 


Equipment Used: List here the instruments needed to perform this SOP. The description 

will include details of calibration, maintenance, and so on, needed to 
ensure the instruments are fit for use. Such detail may be found in a 
separate SOP. In that case, do not repeat the detail here. Simply cross- 
reference the appropriate SOP(s). 

Reagents Needed: List the reagents required, along with pertinent details of their preparation, 

storage, and stability. As with “ Equipment Used,” these details may be 
found in a separate SOP. In that case, do not repeat the detail here-simply 
cross-reference the appropriate SOP(s). 


QC and Analytical Results: 

Describe here the quality control (QC) measures that are taken in this 
procedure. Include (as appropriate) a description of the standards, 
reference materials, control materials, and blanks used. This section 
includes a clear statement of the criteria by which QC results and the 
results of analysis of unknown samples are judged to be acceptable or 
otherwise. A statement of uncertainty in the analytical result appears here. 

Method Validation: This section will probably contain mainly references to other records, such 

as those in which your validation data can be found. Just to reiterate, 
however, validation required you to account for everything that was done 
in your laboratory or elsewhere to prove that the procedure described in 
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this SOP actually does what you claim it does. So, list here the data 
collected during the development of the method, including calibration 
studies, linearity, limit of detection, matrix effects, and recovery studies- 
everything you did to prove the method does what you claim. The 
validation requirements will vary depending on whether you used or 
modified a Standard Method, adapted the method from an article 
published in a professional journal, or developed the method in your 
laboratory. 
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Chapter 9. Traceability 

The term “traceability” can be used in three different contexts in a forensic laboratory. 
First, in discussing calibrations or measurements, the word “traceability” means an unbroken 
series of comparisons between standards that eventually link a laboratory measurement to a 
national or international standard. 

Second, “traceability” has been used to describe the control of reagents and other 
supplies referred to in Section 4.6 (purchasing). The implication was that the reagents and 
reference materials used during a given analysis need to be identifiable via their lot numbers 
and, therefore, traceable to the purchase order by which they were obtained from the 
supplier. Similarly, each lot would be traceable to the record showing how the lot was 
verified for use, who did it, and when. 

Finally, the word “traceability” is sometimes used by forensic scientists in place of the 
terms “continuity of possession” or “chain of custody”. It refers to the unbroken chain of 
transactions leading back to the point at which the exhibit was originally collected. 

However, for our discussion of this requirement of the standard, we shall be concerned 
with the first meaning of traceability, relating to calibration of equipment and instruments. 
As you know, there are several good reasons for calibrating equipment. It gives confidence 
in measurements, for one thing. It may be required to show compliance to some 
specifications. It makes it possible to compare results over time. It’s part of the uncertainty 
estimation. Finally, the law sometimes requires calibration. 

An example of traceability is the critical weighing that you do on an analytical balance 
in your lab. Once a year, for example, you may hire an outside company to service your 
balance. Part of that service is calibration of the weights in it. The service person compares 
your weights with his weights, which are later compared to weights at a national metrology 
organization, and so on, in a chain of comparisons that end up at the international standard 
kilogram. Your laboratory needs to know that the balance service company can demonstrate 
competence, measurement capability, and traceability (which are best shown by its being 
accredited to ISO/IEC 17025:2005 as a calibration laboratory.) The traceability comparison 
made during the service of your balance will be documented in the form of a certificate, 
which can show the uncertainty associated with the comparison. A statement that the service 
company is accredited to ISO/IEC 17025:2005 will also appear in the documentation. In 
North America, ISO-accredited calibration laboratories will be listed with either the National 
Cooperation for Laboratory Accreditation (NACLA) (www.nacla.net) or the Standards 
Council of Canada (SCC) (www.scc.ca) 
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Chapter 10. Uncertainty of Measurement 

We noted earlier that ISO/IEC 17025:2005 appears to have its origins in quantitative 
physical and chemical measurements. Given that, the requirements surrounding uncertainty 
of measurement make perfectly good sense. The standard is merely asserting what we have 
all known since our first university class in physics or chemistry: all measurements have 
some degree of uncertainty associated with them. Good practice demands that the scientist 
be aware of that uncertainty, estimate its magnitude and direction, and express it along with 
the nominal value of every measurement. The point is that nobody who reads the result of 
one of your lab’s measurements should be misled as to its exactness. 

You will recognize this matter of uncertainty as “experimental error,” or at least that’s 
what it was called when we learned about it in undergraduate chemistry. ISO/IEC 
17025:2005 tends not to use the word “error,” possibly because some people understand the 
word “error” to have negative overtones. ISO/IEC 17025:2005 and the standards community 
are taking uncertainty of measurement very seriously indeed. Here’s what that means for 
your lab. 

You have to estimate the uncertainty of measurement for all the quantitative analyses you 
do in your lab. There are metrologically rigorous ways to do that. You will find examples 
on the Eurachem website, referenced later. You may find that the analytical situations 
implicit in those examples and, indeed, in the requirements of ISO/IEC 17025:2005 itself, do 
not resemble your lab’s operation all that closely. For example, the estimation of uncertainty 
is generally imagined as taking place in a routine method of measurement in which large 
numbers of samples are analyzed at regular and frequent intervals. Except for blood alcohol 
and some street drug samples, there may be very few quantitative tests conducted repetitively 
in large volume in the forensic laboratory. In those few situations, where you have plenty of 
replicates on which to do statistics, it’s not difficult to make a reasonable estimate of 
uncertainty. As a first approximation, we suggest you derive a standard deviation (SD) from 
your measurement data. For example, if you run the same control material, batch after batch, 
you obviously have some replicate data from which you can calculate a SD. You can use 
that number to estimate a confidence interval (95% is common) for the measured results of 
your case samples. We hasten to point out that this is not metrologically rigorous. It is, 
however, a useful, practical way to make a reasonable estimate of the uncertainty of those 
measurements. As a first step, perhaps that’s all you need. 

What about the quantitative analysis of unusual drugs, the ones that your lab sees 
possibly once a year, or even once in a lifetime. Does the standard still require an estimate of 
uncertainty of measurement? We believe so; we see no exemption in it for uncommon 
analytes. We suggest an approach like the one just outlined: get an SD, however you can. 

For example, you will certainly have prepared a calibration curve for the unusual drug. It 
will consist of 5 or 6 standards, possibly done in duplicate or triplicate, depending on your 
lab’s practice. When you plot the standard data, spreadsheets (Excel, Quattro) will calculate 
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regression stats if you want them. One of the quantities calculated is S.y/x, which you can 
think of as a standard deviation of the whole calibration line. And there you are. If you use 
this number to work out confidence intervals for unknown values read from the calibration 
curve, you will have a reasonable first approximation of the uncertainty of measurement. We 
repeat, this is not mathematically rigorous, and a professional statistician would not be much 
impressed. Still, it gives a reasonable estimate; that may be all that is required by your 
customers. 

Most of the rest of your lab’s examinations are qualitative analyses such as chemical 
identifications and comparisons of known samples with questioned samples. The results of 
these analyses are obviously not numerical; it isn’t clear how such results could ever be 
treated statistically. In fact, it is not obvious that the concept of uncertainty of measurement 
even has any meaning in some of these analyses. Nonetheless, we think it is necessary to 
give some hard thought to the idea. 

We know that some organizations, such as ILAC, have discussed the concept of 
uncertainty as it applies to qualitative analyses. For now, there has been no decision on this, 
and you are probably free to state that the concept of uncertainty does not apply to your lab’s 
qualitative analyses, such as those conducted in questioned documents, trace comparison, 
and firearms. In the interest of completeness, however, let’s raise some questions that you 
and your colleagues might want to consider. 

«What follows is purely speculative and intended only to stimulate discussion» 

To begin with, it seems that to focus exclusively on numbers and statistics as the only 
way to express uncertainty is too narrow for forensic laboratories. It can be argued that the 
spirit of the standard is more about making sure that the customer is not misled about the 
accuracy or exactness of your test result. We don’t believe it is a stretch to extend this and 
suggest that the customer ought not be misled about the forensic significance of your results 
either. This may give us a direction from which to approach the uncertainty of many forensic 
examinations. Indeed, many conscientious examiners are already doing this. It has just never 
been called “uncertainty of measurement” before. Here are some specific ideas and 
questions. 

If your toxicology lab offers any screening tests in which a single analysis is expected to 
respond to multiple analytes, would it not be useful to have lists of possible analytes that 
could be supplied to customers? This suggests a list of all the analytes you know are detected 
by the screen (or, more accurately, analytes that you have shown during validation studies to 
be detectable in the screen). We think that such a list should be supplemented by a second 
list-all those analytes that you know would not be detected in the screening procedure. You 
would be able to compile this list, too, from the validation data. Certainly, if your customers 
had these two lists to consult, it is far less likely that they could claim to have been misled 
about the accuracy of your reported result. 
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Is there any uncertainty at all in the result of a physical match? For example, suppose one 
of your examiners matches a piece of broken red plastic to a broken taillight lens. Is there 
any possibility whatsoever that the two were not at one time part of an intact whole? If there 
is absolutely no uncertainty, perhaps it would be a good idea to say so, in so many words. 

In a similar fashion, is there any uncertainty at all about the identity of a chemical 
compound on which one of your chemists has obtained a mass spectrum (MS) or an infrared 
spectrum (IR)? We think your chemist would say that, in most instances, there is no doubt 
whatsoever and there is no uncertainty in that identification. But, that’s not so in all 
applications of MS or IR, so care is required. 

If an examiner identifies the writer of a signature, what is the uncertainty in that result? 
It’s probably never as certain as the identification of heroin by mass spectrometry, for 
example; and, as documents examiners have known for years, the uncertainty varies from 
case to case. We would argue that the customary practice of reporting gradations of 
confidence is, in fact, an expression of uncertainty in documents examination. 

If an examiner determines that a particular bullet was fired from a specific weapon, is 
there any uncertainty in that result? If there isn’t, why not just say so? Is this determination 
comparable to the physical match example above, or is it more like a handwriting 
comparison? Of course, the criteria for declaring a match would have been written down so a 
second examiner can repeat the original examination, if that seems useful. 

If one of your examiners finds a match of common white cotton fibres between known 
and questioned exhibits, how does he or she handle the fact that such fibres are found almost 
everywhere? We suggest that the interpretation of the forensic significance of such a match 
is a way to make sure the customer is not misled. 

There are similar areas in forensic science where subjective examinations and 
comparisons are successfully made with appropriate conclusions and opinion. We believe 
this is compliant with the spirit of ISO/IEC 17025:2005. 

We emphasize: these questions are all speculative. They simply represent possible 
ways in which the concept of measurement uncertainty could apply in forensic science. 
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Chapter 11. Internal Audits (IA) and Reviews 

These notes should be viewed mainly as suggestions for setting up a program of internal 
audits in your lab. Exactly what needs to be done in an individual lab at any given time is a 
judgement that you and your management can make in the light of what is required by your 
lab’s policies and procedures, and by ISO/IEC 17025:2005. 

As noted earlier, you are required to perform an IA on all your lab’s sections at least once 
a year (ISO/IEC 17025:2005, 4.14) to see if you are doing things right , to see if you are 
following your own policies and procedures. You might find it useful to think of the IA as 
connecting closely with the management review (4.15). To begin with, the results of all 
audits, whether internal or external, are to be considered in the management review, which is 
a look at the entire management system by executive management. The management review 
is intended to ensure that you are doing the right things. Finally, the management review is 
supposed to occur annually, just as Internal Audits are. You, as the quality manager, will 
likely be involved at all stages of your lab’s management review. 

In the preparation for your initial accreditation visit, you should choose to do a full audit 
of every lab section, perhaps as a gap audit, to be repeated at intervals of much less than a 
year. After that, you have to do a full audit of each section at least every year to comply with 
the requirements. However, within this routine schedule, there are reasons why you might 
choose to audit only a portion of a section, and why you might choose to run an audit at some 
interval less than a year. 

Given that preamble, you’ll want to get down to business. You will need to write an LA 
Procedure and keep records of everything you do. Remember, “If it ain’t documented, it’s 
just a rumour,” and this applies to audits, too. You’ll need to be able to show in the future 
what was audited, how, who did it, when, what the results were, and what happened as a 
consequence. 

Each IA requires an Audit Plan. It need not be a long document, but it should contain the 
essential facts to keep you on track. Be sure that everybody is clear what you’re going to do 
on any given audit, and write it down. While you’re writing the Audit Plan, you and your 
audit team will have to give some thought to exactly what steps you’re going to take to 
actually carry out the audit. There may be other ways to organize your approach to the 
section; but possibly the simplest scheme, and one that makes intuitive good sense, is to take 
a case file and track it through the section by looking at every step from receipt of the case to 
the report. That’s the model we’ll use below. 

To begin, collect all the documents you need. For general reference, you’ll want copies 
of ISO/IEC 17025:2005, your Quality Manual, your Procedure for Internal Audits, and ISO- 
19011 (Guidelines for Quality and/or Environmental Management Systems Auditing) to 
provide the ISO description of an audit. 
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For use in the present audit, you need the specific section documents you identified in 
your audit plan. This might include a section manual, SOPs, procedures, and methods. 

You also need a checklist. You have some choice here. Your accreditation body may 
supply you with a copy of the checklist they will use during your accreditation audit. This 
document is typically just the text of ISO/IEC 17025:2005 rewritten in the format of a 
checklist with spaces for checkmarks and remarks. You can use this, but eventually you will 
want to prepare your own checklists for your own specific purposes. Don’t forget, you are 
auditing the activities of the section primarily by following the quality documents prepared 
by your laboratory. Try to ensure that they also meet the requirements of the standard, as 
you interpret them. Whatever the case, a checklist is absolutely essential to keep your team 
on track. Do not attempt an audit without one. 

You will have prepared a schedule so that every section (including the administraation 
unit) gets audited as stated above. Make sure the section knows ahead of time, and agrees 
with your schedule. The section should also be told to carry on with a normal workday, as 
best they can. In our experience, it is possible to audit a lab section every other day, if you 
are trying to do the IA of the entire laboratory in one session. That will give enough time 
(just barely, doing nothing else) to get the report out the day after the audit of one section and 
to prepare for the next one. We believe that one of the main points of your IA is to provide 
feedback to the section. So we urge you to turn your audit reports around within a day. 

While it is possible to run all your IAs in a single marathon session, as implied above, 
there is no particular need to do so. You can structure your audit schedule to do the various 
sections at different times in the year, or you can select particular elements of the standard 
and audit these through every section. As an example, you might choose to audit traceability 
(5.6), method validation (5.4.5), and assurance of quality (5.9) in one audit session in every 
lab section in which they apply. Then, at another time, you might audit other elements of the 
standard. However it is done, the entire management system has to be audited to all elements 
of the standard at least once a year. 

Choose your audit team. There are several points that you will want to consider. First, 
while you as quality manager might take on the lead role yourself, there seems to be no 
reason why this could not be delegated to someone else. You will have recognized, however, 
that the spirit of the quality standard is that management of the lab be closely involved with 
quality matters. So, delegation of the lead role is fine-abandoning the team to their own 
devices is certainly not. 

Second, depending on the scope of the audit and the size of the section, pick one or two 
others to work with the leader. As a general rule, you’ll want people from sections other 
than the one you’re going to audit. They must have some training in auditing. 
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Third, teams of 2 to 4 seem to work well. A team approach spreads around the burden of 
auditing, for one thing, and the group discussions that a team makes possible probably lead 
to a more effective audit. 

Finally, in the audit plan, decide within the team who is going to do what, and write it 
down (ISO 19011; 5.2.1). Supply copies of the checklist for everyone. This is probably the 
minimum you’ll need in the way of working documents (ISO 19011; 5.2.3). 

Whatever other documents you have identified in your Audit Plan, get the Section 
Manual and read it. It works fine to do this the afternoon before you audit the section, but 
you must do it. It’s in that manual that you find the details of what goes on in the section (or 
what the writer claims is going on in the section, which is not necessarily the same thing). 

On the day of the audit, hold your opening meeting (ISO 19011-1; 5.3.1) with the 
section. These may be a little shorter and less formal than the meetings held when your 
accreditation body makes its on-site visit to your lab, but you need an opening meeting. This 
is the time to tell everyone what the scope of the audit will be. Tell the section staff that, 
while you will have questions for them from time to time, they should go on about their 
normal day. This is also a good time to collect whatever case files you need. 

Pull case files, as you have decided. The audit team will have sorted this out in advance, 
as a team. As a rule of thumb, you’ll want at least one file from each analyst so you can 
assess how the requirements concerning reports, case notes, analytical data, and so on, are 
handled. You’ll also want to give some thought to different case types. For example, do you 
want to see a glass case, and an arson case, and a paint case from the Trace Evidence 
Section? And one of each per analyst? The team will have decided this. 

Pick one case file and track it through the section. Work through from exhibit receipt to 
report, or the reverse, whichever makes most sense to you. This can be difficult, mainly 
because the audit team will be familiar with at least some of the things on the checklist, and 
it is tempting for them to fill in the blanks with what they think happens. Resist the 
temptation and walk the case through. Actually go to the exhibit reception area; yank on 
doors that are supposed to be locked; read what gets recorded; look at the labels on the 
prepared reagents. Watch what the analysts actually do. That’s why you want to have people 
working. You say, over and over: “Please show me how this is done, where this is 
documented, where that policy is written....” Record what you see, hear, and read, ticking 
through every item on the checklist. Take your time and, if you miss something, don’t guess, 
go back and check again. 

When you have tracked the case through, find a private place for a meeting of the audit 
team and go through the checklist again. At this point, you’re trying to decide (as a team) 
whether you have conformance or not on each item, or whether you need more information. 
If you need to ask something else, go back and ask. Don’t assume and don’t guess. 
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Read through the rest of the case files you pulled. As noted earlier, this will mainly be to 
check for compliance with sections 4.13 and 5.10 of ISO/IEC 17025:2005. If you were 
concerned about different cases types, however, there may be some instruments or 
procedures that you didn’t observe on the walk-through described above, and you need to go 
back to the section and check them now. Please do it. 

The team leader drafts the report and circulates it to members of the team. The format 
for these reports should follow your guideline for reports in the IA Procedure. There is no 
official format for these reports that we are aware of. Use a table format, if you like, or write 
it as a simple To-Do list. Whichever you choose, be quite clear and explicit about which of 
your findings are Required Actions (no option, fix it by the agreed-upon diary date) or 
Suggestions (don’t have to do it at all, we’re just trying to be helpful). Every point you make 
in the report has to be referenced to the standard by element number. Every Required Action 
will have a completion date attached, a date worked out in discussion between the team 
leader and the section head. 

The closing meeting (ISO 19011-1; 5.3.3) might be short and informal, like the opening 
meeting, especially if your sections are small. It is possible that discussions during the audit 
might have involved pretty well everybody. Whatever the case, the goal is that everybody in 
the section ought to know your team’s findings; there should be no surprises. 

Your lab’s management should determine who receives copies of audit reports and that 
ought to be included in your IA Procedure. ISO 19011 states that audit reports will not be 
copied to other sections which were not audited. Another view is that the IA reports contain 
information that everybody in the lab could, potentially, benefit from. So it could be argued 
that at least all other section managers should get copies. This is a decision to be made in 
your lab. 

Corrective Action Requests (CARs) are issued for each Required Action. They include 
the due date, and the person responsible for fixing the identified problem. Although the 
quality manager is responsible overall for the audit process, the monitoring and follow-up 
can be delegated to someone else. 

Follow up checks (verification audit) will have to be done in order to be certain that 
corrections were actually made. As the QA leader, you would look after the schedule; but 
another member of your audit team could be asked to follow up a specific corrective action, 
possibly because that member was the one who made the finding in the first place. 

When the IA of a section is finished, have a colleague audit your IA procedure and 
documentation. Of course, you’ll need a written procedure and checklist for this, too. The 
point is simply to make sure that all necessary steps have been taken in the IA and that the 
file of that audit is properly completed. It is important that each corrective action be signed 
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off when it is complete and accepted. For some corrective actions, follow-up is necessary to 
see that the action taken is both in compliance and effective. As mentioned, the content of 
the audit cycle (completed and in progress) becomes part of the managerial review, which is 
the final step in the follow-up process. 

Finally, you will know that all audits are to be done by people who have appropriate 
training. You can arrange for outside courses or on-site courses provided by consultants. 
Certainly, some outside training is recommended. However, to start, it is acceptable for one 
of your colleagues to be part of an IA team as an observer or a learner. This on-the-job 
training has to be documented, but it can certainly “count.” 
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Chapter 12. Taking It Forward 

That’s it for a start. Here is a quick summary of the topics we have discussed. 

By now you should have looked closely at ISO/IEC 17025:2005 to see if it is what you 
want in a quality standard. It is a well-recognized standard, used throughout the world for all 
types and sizes of laboratories. You must meet the elements of this standard, both management 
and technical parts, to be accredited. You have to be able to meet these elements of ISO/IEC 
17025:2005 before considering if you want to extend or amplify its application further to 
program specialized areas, such as forensic laboratories. If you go for accreditation in a 
specialized area, the accreditation team will cover elements of both the primary standard, 
ISO/IEC 17025:2005, and any amplification document that applies. 

The senior management of your lab has to be committed to making the laboratory 
compliant with the quality standard and to seeking accreditation. Without this vital support and 
leadership, efforts to implement this quality program will not succeed. 

Introduce the concepts of quality assurance and accreditation to your colleagues and 
provide training to appropriate staff. This can be the start of planning a strategy for 
implementing a quality-based laboratory system. 

Communicate with the accrediting body you want to work with, so you are aware of their 
requirements and possible interpretations of the standard. 

Talk with your customers, as well, and with other parts of the organization to which you 
belong, to ensure that they understand accreditation and the new policies that your lab might be 
implementing. It would be especially effective if your customers heard about this from your 
lab’s senior management 

The big step is documentation. Lay out the hierarchy of your lab’s quality documents. 
Determine a consistent format for the management system manual, procedures, work 
instructions, forms, and records. Develop clear policy. Seek input from the personnel who are 
doing the various jobs in your lab such as the clerks, the chemists, and the cleaners. Then revise 
the documentation. This is likely the most demanding part of the implementation process. 

Watch for compliance at every stage. Conduct internal audits to check that all operations 
are following the policies, procedures, and instructions as written by your lab. Ensure that what 
you have written is in compliance with the standard. 

After accreditation, it is a matter of using the tools in your quality program to 
continuously improve your lab’s operation and ensure customer satisfaction: corrective actions, 
preventive actions, internal audits, and management reviews. 
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Finally, you can expect dividends in terms of improved efficiency, confidence, pride, and 
satisfaction. The quality program should give senior management increased confidence in the 
ability of the lab to offer a reliable service. It will give staff members pride in knowing that the 
quality of their work meets criteria set by a recognized international standard. Finally, customers 
of your laboratory (police, courts, public) will have the assurance of knowing that the results 
provided by your laboratory would be accepted by any other accredited labs around the world. 
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Chapter 13. Useful Sources of Information 


1. Asia Pacific Accreditation Co-operation (APLAC) www.aplac.org 

Go to “Documents” - “List of Available Documents” - Technical Committees. 
Download: 

APLAC TC002 - Internal Audits for Laboratories and Inspection Bodies 
APLAC TC003 -Management Reviews for Laboratories and Inspection Bodies 
APLAC TC005 - Interpretation and Guidance on the Estimation of Uncertainty of 
Measurements in Testing 

2. International Laboratory Accreditation Co-operation (ILAC) www.ilac.org 

Go to “Publications”. 

Download: 

ILAC G2 - Traceability of Measurements 

ILAC G15 - Guidelines for ISO/IEC17025 Accreditation 

ILAC G17 - Introducing the Concept of Uncertainty of Measurement in Testing in 

Association with the Standard ISO/IEC 17025 

ILAC G19 - Guidelines for Forensic Laboratories 

ILAC P10 - ILAC Policy on Traceability of Measurement Results 

3. Eurachem www.eurachem.ul.pt 

Go to “Guides/ Documents”. 

Download: 

- Traceability in Chemical Measurements 

- Guide to Quality in Chemical Measurement 

- Quantifying Uncertainty in Analytical Measurement 

4. Forensic Quality Services www.forquality.org 

5. American Society of Crime Laboratory Directors- Laboratory Accreditation Board 

www.ascld-lab.org 

6. Association of Forensic Quality Assurance Managers www.afqam.org 


- END OF DOCUMENT - 
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